Umbraco 13 reaches end of life on 14 December 2026. From that date it will no longer receive security updates from Umbraco HQ, and the .NET 8 framework it runs on loses Microsoft support even sooner, on 10 November 2026.
If your website still runs on Umbraco 13, now is the time to plan your Umbraco 13 to 17 upgrade. In this article we explain what end of life really means, the risks of standing still, what it means for Cyber Essentials, and how long an Umbraco 13 to 17 migration typically takes.
Umbraco 13 EOL Date: When Does Umbraco 13 Reach End of Life?
Umbraco 13 was released on 14 December 2023 as a Long-Term Support (LTS) version, which gives it three years of life: two years of full support followed by a year in the security phase. It has been in that security-only phase since 14 December 2025, and it reaches end of life on 14 December 2026. You can see the dates on Umbraco's own Umbraco 13 EOL page.
Milestone | Date |
|---|---|
Umbraco 13 released | 14 December 2023 |
Security phase begins (security fixes only) | 14 December 2025 |
.NET 8 end of support (Microsoft) | 10 November 2026 |
Umbraco 13 end of life | 14 December 2026 |
The .NET 8 Deadline Comes First
Umbraco 13 is built on .NET 8, and Microsoft ends support for .NET 8 on 10 November 2026. That is more than a month before Umbraco 13 itself reaches end of life. After that date, any new vulnerability found in the .NET 8 runtime or ASP.NET Core 8 will not be fixed, even though Umbraco 13 is technically still in its security phase.
What Does Umbraco 13 End of Life Actually Mean?
Your website will not suddenly stop working on 15 December 2026. It will carry on serving pages, and editors will still be able to log in to the backoffice and publish content, just as they did the day before.
What changes is that Umbraco 13 and .NET 8 will no longer be supported. In practice that means:
No more security patches from Umbraco HQ for newly discovered vulnerabilities
No more security updates from Microsoft for the .NET 8 runtime underneath your site
No bug fixes, and no official support if something goes wrong
Third-party packages will gradually stop releasing updates for Umbraco 13 as their authors move on to newer versions
Umbraco does offer paid Extended Long-Term Support (XLTS) for Umbraco 13, which provides critical security patches beyond end of life. It can buy you time if you genuinely cannot migrate before December, but it is a stop-gap rather than a long-term plan.
The Security Risk of Not Upgrading from Umbraco 13
The real danger is not what is known today, but what is discovered tomorrow. Umbraco has issued several CMS-wide security fixes in recent years, and supported versions receive patches quickly. Once Umbraco 13 is end of life, any vulnerability found after 14 December 2026 simply cannot be patched on your site.
Attackers know this. Unsupported software is an attractive target precisely because fixes will never arrive, and once a vulnerability is published, automated scanners can find exposed sites within hours.
The knock-on effects go beyond the website itself:
Data protection: UK GDPR requires appropriate technical measures to protect personal data, which is hard to demonstrate on unsupported software
Insurance: cyber insurers increasingly ask about end-of-life systems, and unsupported software can affect cover or claims
Procurement and audits: clients, partners and public sector buyers often ask whether your systems are supported
How AI Is Speeding Up the Discovery of Security Vulnerabilities
AI tools are making it faster and cheaper than ever to find and exploit software flaws. That makes unpatched software far more dangerous than it was even a year ago, and it is a strong reason not to run Umbraco 13 past its end-of-life date.
AI is finding flaws humans missed for decades: in April 2026, Anthropic announced Project Glasswing, after its Claude Mythos Preview model found thousands of high-severity vulnerabilities, including flaws in every major operating system and web browser and one OpenBSD bug that had gone unnoticed for 27 years.
Exploiting vulnerabilities is now the top way breaches start: the Verizon 2026 Data Breach Investigations Report found vulnerability exploitation behind 31% of breaches, up from 20% the year before, overtaking stolen credentials and phishing for the first time. Verizon also reports attackers using generative AI at several stages of an attack.
Vulnerability numbers are rising fast: Patchstack's State of WordPress Security in 2026 recorded 11,334 new vulnerabilities in the WordPress ecosystem in 2025, a 42% increase on 2024.
Attacks start within hours: the same report found that heavily targeted vulnerabilities were exploited a median of 5 hours after being made public, and warns that attackers are increasingly equipped with AI capable of finding and exploiting vulnerabilities on its own.
What This Means for .NET and Umbraco Sites
.NET and Umbraco are not immune. In October 2025, Microsoft patched CVE-2025-55315, a request smuggling flaw in ASP.NET Core's Kestrel web server. Its CVSS score of 9.9 was the highest Microsoft has ever given an ASP.NET Core vulnerability, and it affected .NET 8. Sites on .NET 8 could be fixed with an update. Had the same flaw been found after 10 November 2026, they could not.
Umbraco 13 has needed security fixes during its life too. In June 2025, CVE-2025-49147 exposed configured password rules through an anonymous endpoint in Umbraco 10 and 13, and was fixed in Umbraco 13.9.2. After end of life, a similar issue would simply stay open.
There is a further risk. When a vulnerability is fixed in a supported version such as Umbraco 17, the published fix can point attackers towards the same weakness in older versions. AI tools make analysing those fixes much quicker, so the gap between a patch for Umbraco 17 and an attack on an unpatched Umbraco 13 site is likely to keep shrinking.
Umbraco 13 and Cyber Essentials
If your organisation holds Cyber Essentials or Cyber Essentials Plus certification, this is not optional. The scheme requires all in-scope software to be licensed and supported by its vendor. Software that becomes unsupported must be removed, replaced, or brought back into support, and high and critical security updates must be applied within 14 days of release.
An internet-facing website running Umbraco 13 on .NET 8 after their end-of-life dates is unlikely to meet those requirements. That could put your certification at risk at your next renewal, and with it any contracts that depend on it, particularly in the public sector and supply chains where Cyber Essentials is a condition of doing business.
If renewal falls in late 2026 or early 2027, it is worth planning your Umbraco 13 migration around that date rather than the December deadline alone.
Still Running Umbraco 7, 8 or 10? Upgrading Older Umbraco Sites
If your site is on an older version, you are already out of support. Umbraco 7, 8 and 10 have all passed end of life, as have the short-term releases 11, 12, 14, 15 and 16. Sites on these versions have been missing security fixes for some time.
Older sites, especially Umbraco 7 and 8 on .NET Framework, usually need more than an upgrade. Moving to Umbraco 17 often means a rebuild of the front end and backoffice customisations alongside a content migration, so the earlier you start your Umbraco upgrade, the better.
Why Upgrade from Umbraco 13 to Umbraco 17?
Umbraco 17 is the current Long-Term Support release, built on .NET 10, which is itself an LTS version of .NET. Upgrading from Umbraco 13 to 17 gives you a supported platform until late 2028, with full support until November 2027 and security fixes for a year after that. The next LTS, Umbraco 21, is not planned until December 2027, so Umbraco 17 is the sensible target for anyone leaving Umbraco 13.
Beyond support, Umbraco 17 brings real improvements:
A modern backoffice: rebuilt from the ground up with web components, faster and easier to extend than the old AngularJS backoffice
Better performance: a newer caching model and the performance gains of .NET 10
Improved editing: a more consistent Block List and Block Grid experience for content editors
Long-term stability: a clear upgrade path to future LTS versions without another major rewrite
What Changes Between Umbraco 13 and 17?
The biggest change is the backoffice. Anything built for the Umbraco 13 backoffice, such as custom property editors, dashboards and content apps, needs rebuilding for the new one. Some older features have also been removed, including Nested Content and macros, so content using them has to be migrated to blocks. Third-party packages need checking too, as not all have been updated.
How Long Does an Umbraco 13 to 17 Migration Take?
It depends on how complex your site is. As a rough guide:
Type of site | Typical timescale |
|---|---|
Smaller brochure-style site, few customisations | 1 to 2 weeks |
Medium site with custom document types, blocks and some packages | Several weeks |
E-commerce sites, heavy integrations or custom backoffice components | Several months |
What Affects Umbraco Migration Cost and Timescale?
Custom backoffice extensions: property editors, dashboards and content apps need rewriting for the new backoffice
Integrations: CRMs, payment providers, search, single sign-on and other APIs all need testing and often updating
E-commerce: product catalogues, checkout flows and order data need careful handling, whether on Umbraco Commerce or a third-party solution
Third-party packages: some have Umbraco 17 versions, some need replacing
Legacy content: Nested Content and macros need converting to blocks
Hosting: your server or Umbraco Cloud environment must support .NET 10
Time Is Already Running Out
With the .NET 8 deadline only weeks away and Umbraco 13 end of life soon after, there is not much time left. Agencies are busy with migrations, and larger projects need time for scoping, development, testing and content checks. Starting your Umbraco 13 to 17 migration now gives you the best chance of being on a supported platform with as little exposure as possible.
Umbraco 13 to 17 Migration Services from Nevitech
We have been migrating Umbraco 13 sites to Umbraco 17 since Umbraco 17 was released at the end of 2025, from small brochure sites through to complex builds with custom backoffice extensions and integrations. As an Umbraco Silver Partner that has worked exclusively with Umbraco since 2013, we know the platform inside out, from Umbraco 7 through to 17, on Umbraco Cloud, Azure and Windows Server hosting.
Every Umbraco migration starts with an audit of your current site: your packages, customisations, integrations and content. That lets us give you a clear picture of the work involved, a realistic timescale and a fixed quote before anything starts.
Start Your Umbraco 13 to 17 Upgrade
Whether you are on Umbraco 13 or an older version that is already out of support, do not leave it until December. Find out more about our Umbraco 13 to 17 migration services and get in touch to discuss your site.
Written by Justin Neville
Justin has worked in software development since 1998. He began writing C and C++ applications, moving to C# and .NET development in 2002. From 2002 to 2013 he built large-scale internal web applications for major companies in the finance and insurance sectors. In 2013, he founded Nevitech IT Solutions Ltd, and since then has focused exclusively on building and supporting websites using Umbraco CMS.
Justin is an Umbraco Certified Master and an Umbraco MVP for 2026. He won the Umbraco AI Package Award for his AI Log Analyser package, contributes to the Umbraco CMS core, and co-organises the Umbraco Kent Meetup. His particular strengths include system architecture, performance optimisation, complex troubleshooting, and writing clean, scalable code. He also mentors junior developers and works closely with agency partners on complex builds requiring specialist expertise.
