.NET 8/9 end of support vs Windows Server 2012 ESU cutoff in fall 2026

TL;DR

---

.NET 8 and .NET 9 reach end of support on November 10, 2026, and four weeks earlier, October 13 is the last day of Extended Security Updates (ESU) for Windows Server 2012 / 2012 R2.

The .NET 8/9 deadline covers your application’s target framework and runtime, while the Windows Server 2012 deadline is the end of the OS itself. That raises the question of where any legacy .NET Framework or line-of-business apps on that OS will run next.

.NET 8 LTS and .NET 9 STS stop on the same day, November 10

Microsoft announced on the official .NET Blog that both .NET 8 and .NET 9 reach end of support on November 10, 2026. The .NET support policy lists .NET 8 as LTS (Long Term Support), released November 14, 2023, with support ending November 10, 2026. .NET 9 is STS (Standard Term Support), released November 12, 2024, and its support ends on the same November 10, 2026.

An LTS release (.NET 8) and an STS release (.NET 9) ending on the same day is where the confusion starts. LTS means longer support than STS, not indefinite support until the next LTS ships. The migration target, .NET 10 LTS, has been out since November 11, 2025, with support running to November 14, 2028. You are not waiting for a successor here; it has been available for a full year before the deadline.

Apps will not stop running the moment support ends. What stops is security fixes, servicing updates, and technical support. If a CVE surfaces afterward, the affected runtime simply never receives the patch. November 10 is also a Patch Tuesday, and the announcement notes that .NET 8 and .NET 9 may each receive one final update that day if a critical issue is known.

Back in April this blog covered CVE-2026-40372, the ASP.NET Core privilege escalation. That bug was introduced on the .NET 10 side, and .NET 8/9 were unaffected. After November 10 the positions flip: the next time a vulnerability appears, only the in-support .NET 10 side receives the fix.

Microsoft itself sells no paid extended support for .NET. If the migration will not make it in time, the fallback is third-party extended support such as HeroDevs’ NES for .NET 8.

October 13 is the last day of Windows Server 2012 ESU

Windows Server 2012 and 2012 R2 exited regular extended support on October 10, 2023. What remained was ESU, and Microsoft’s Windows Server ESU overview lists October 13, 2026 as the ESU end date both on Azure and on-premises.

ESU is not new features or regular bug fixes; it is limited to security updates rated Critical or Important. Microsoft Learn also states that update delivery stops once the ESU period ends. From October 13 onward, the choice is between keeping the OS with no more OS-level fixes and migrating.

The reason Windows Server 2012 machines survive is usually the apps above the OS rather than the OS itself. Legacy .NET Framework apps, line-of-business software whose vendor stopped updating, and configurations tied to specific drivers or hardware are what keep the OS pinned. Unlike modern .NET, .NET Framework has no standalone annual LTS cycle; its lifecycle follows the Windows version hosting it. That means the Windows Server 2012 deadline can double as the deadline for the legacy .NET Framework apps running on it.

Microsoft’s options come down to two. Migrate on-premises to a newer Windows Server, or move the VM into Azure and receive ESU at no extra charge. The Azure route only buys time for the OS, though; the apps’ inability to update stays exactly where it was.

For the on-premises path, starting with Windows Server 2025, nonclustered in-place upgrades support jumping up to four versions at a time. The same ESU overview page shows going directly from 2012 R2 to 2025 as an example. In that configuration, the old multi-hop plan through intermediate versions is no longer required.

Close deadlines, different migrations

The October–November 2026 ops calendar has other deadlines packed around these two. Windows 10 consumer ESU was originally set to end on the same October 13, but in June 2026 Microsoft extended it by one year to October 12, 2027. Python 3.10 and PostgreSQL 14 also hit their deadlines in October–November 2026. For Node.js, as covered in the Node.js 26 article, older release lines drop out of security fixes after EOL. Among Microsoft’s own deadline events, the June 2026 CA expiration covered in the Secure Boot 2023 certificate article fell in the same year.

The unit of work is different, though. For .NET 8/9 you check the combination of TargetFramework in project files, SDKs, CI, hosting environments, and dependency packages. For Windows Server 2012 the checklist widens to the OS plus Hyper-V and VM infrastructure, everything around Active Directory and file shares, and vendor support for the apps on top.

If it is .NET only, verifying the move to .NET 10 may be all it takes. The breaking changes from 8 to 10 are collected in the official compatibility list. For Windows Server 2012 the paths split further: whether the app runs on a newer OS, whether an in-place upgrade is enough, or whether an Azure detour comes in between.

Keep .NET targets and Windows Server hosts in separate columns

For .NET, check production runtimes separately from SDKs. A dev machine with the .NET 10 SDK installed does not help if the production container or VM still runs the .NET 8 runtime; that is exactly what the deadline catches. For Visual Studio 2022, Microsoft writes that a future servicing update will mark the .NET 8 and .NET 9 components as out of support. They will not vanish from existing installs; they get flagged, with an option to remove them.

For Windows Server 2012, a list of hostnames and counts leaves the app-side blockers out. Which line-of-business apps run on each host, whether they use authentication or file shares, and whether the vendor supports a newer OS belong in the same row. If you were buying ESU, there is essentially no path to buy more coverage past October 13, 2026.

In a mid-2026 tracking sheet, keep .NET target and Windows Server host as separate columns. A sheet that mixes them in one column can only tell a runtime-update row from an OS-migration row by the deadline date.