Configuration Manager 2509 End of Support: May 12, 2027
Microsoft ends support for Configuration Manager current branch version 2509 on May 12, 2027. It is the oldest of the three versions Microsoft still supports, and the first to go: 2603 follows on November 5, 2027 and 2609 on March 28, 2028. Version 2503 already left support on September 30, 2026. Live status and EOL Risk Score for each version are on the Configuration Manager page.
Key Dates at a Glance
- Configuration Manager 2609: support ends 2028-03-28
- Configuration Manager 2603: support ends 2027-11-05
- Configuration Manager 2509: support ends 2027-05-12
- Configuration Manager 2503: support ends 2026-09-30
The supported versions, as Microsoft prints them
These rows come from the Supported versions and Historical versions tables on Microsoft's Configuration Manager servicing page. Microsoft notes that the availability date is when the early update ring was released.
| Version | Available | Support ends | Updates it receives today |
|---|---|---|---|
| 2609 | September 28, 2026 | March 28, 2028 | Security and critical updates (latest version) |
| 2603 | May 5, 2026 | November 5, 2027 | Security updates only |
| 2509 | November 12, 2025 | May 12, 2027 | Security updates only |
| 2503 | March 31, 2025 | September 30, 2026 | None: out of support |
What Microsoft's support policy says
Microsoft's page on support for Configuration Manager current branch versions sets the rules behind the dates:
- 18 months: each update version remains in support for 18 months from its general availability release date, with technical support for the whole period.
- Security and Critical Updates phase: the latest current branch version receives both security updates and critical updates (widely released fixes for critical, non-security bugs).
- Security Updates (Only) phase: once a newer version is released, older versions receive only security updates for the rest of their 18 months.
So the support end date is not the only date that matters. Version 2509 stopped receiving critical, non-security fixes when 2603 was released, and it now gets security updates only until May 12, 2027.
Why the date matters: CVE-2024-43468
CVE-2024-43468 is an SQL injection in Configuration Manager that, in CISA's words, an unauthenticated attacker could exploit by sending specially crafted requests. Microsoft rates it 9.8, Critical. CISA added it to its Known Exploited Vulnerabilities catalog on February 12, 2026, with a remediation due date of March 5, 2026 for US federal agencies.
Microsoft's Security Update Guide lists three affected versions, 2303, 2309 and 2403, each fixed by hotfix KB29166583, released October 8, 2024. Those were the versions in support at the time. Version 2303 left support on October 10, 2024, two days after the hotfix. Microsoft's list names no older version and the hotfix is published only for those three, so for a site still on 2211 or earlier Microsoft has said nothing about whether it is affected and has published no fix it can install. Versions 2409 and later, released after the hotfix, are not listed as affected.
What to do
- Find your version: compare the version your site runs with the table above.
- On 2509: plan the update to 2609 before May 12, 2027. Moving to the latest version also brings back critical, non-security fixes.
- On 2503 or older: you are out of support today. Update to a supported version, and on 2403, 2309 or 2303 confirm hotfix KB29166583 is installed until you do.
- Check other versions: the Configuration Manager page re-reads Microsoft's dates at every build, and the EOL Checker answers for a single version.
Frequently Asked Questions
When does Configuration Manager 2509 support end?
Microsoft's Configuration Manager servicing page gives version 2509 a support end date of May 12, 2027, 18 months after its availability date of November 12, 2025.
Which Configuration Manager versions are supported?
Microsoft lists three supported versions of Configuration Manager current branch: 2609 (support ends March 28, 2028), 2603 (November 5, 2027) and 2509 (May 12, 2027). Version 2503 left support on September 30, 2026.
Does every supported Configuration Manager version get the same updates?
No. Microsoft's support policy gives the latest current branch version both security and critical updates. After a newer version is released, older versions receive only security updates for the rest of their 18 months.
Which Configuration Manager versions got the CVE-2024-43468 fix?
Microsoft's security update guide lists versions 2303, 2309 and 2403 as affected and fixed by hotfix KB29166583, released October 8, 2024. It lists no older version. CISA added CVE-2024-43468 to its Known Exploited Vulnerabilities catalog on February 12, 2026.
Related
- Microsoft Configuration Manager — every version and its dates
- Windows Server 2016 end of support — another Microsoft deadline for the same estates
- Microsoft 365 Apps versions — which channels and builds are still in service