September 30, 2026: The Worst Deadline Day of the Quarter
On September 30, 2026, nine vendors' clocks stop on the same day — and none of them coordinated it. That day: Microsoft retires Project Online outright (the service stops existing, and Microsoft's guidance is to back up your data first); FortiOS 7.2 reaches end of support on the internet-facing firewall OS with the deepest KEV history on our books; SonicWall's SonicOS 7.3.0, 7.3.1 and the 7.0.1-5169 build all reach end of support at once (7.3.2 was on the same list until SonicWall re-typed it as a General Release with end of support on Feb 23, 2027); Zyxel's USG2200 and USG2200-VPN firewall appliances hit end of development, end of vulnerability support, and full end of life simultaneously — every remaining lifecycle milestone on one day (Sophos Firewall SFOS 22.0 GA was on this list until Sophos revised its retirement calendar on September 24 and moved its end of support to October 30, 2026); and ten Azure services and APIs — Azure Virtual Desktop (Classic) and three generations of Service Bus control-plane APIs among them — retire. Azure Functions apps still on the v3 runtime in Linux Consumption plans stop running after the same date.
The cluster, in one table
| What | Vendor | What happens Sep 30 |
|---|---|---|
| Project Online | Microsoft | Retirement — service stops; data unreachable after the date |
| FortiOS 7.2 | Fortinet | End of support: Sep 30, 2026 |
| SonicOS 7.3.0 / 7.3.1 | SonicWall | End of support: Sep 30, 2026 (SonicWall's stated upgrade path: 7.3.2, which now runs to Feb 23, 2027) |
| SonicOS 7.0.1-5169 | SonicWall | End of support: Sep 30, 2026 |
| Zyxel USG2200 / USG2200-VPN | Zyxel | End of vulnerability support and full end of life: Sep 30, 2026 — every remaining milestone at once |
| Sophos Firewall SFOS 22.0 GA | Sophos | Moved off this date: end of support is now Oct 30, 2026 (Sophos retirement calendar revised Sep 24; 22.0 MR1 and MR2 stay supported) |
| Cloudera Data Flow 3.0 | Cloudera | End of support: Sep 30, 2026 |
| Cloudera on cloud 7.2.18 | Cloudera | End of support: Sep 30, 2026 |
| FreeBSD 15.0 | FreeBSD Project | End of life: Sep 30, 2026 (released Dec 2, 2025) |
| Nextcloud 32 | Nextcloud | End of life: Sep 30, 2026 |
| Prometheus 3.14 | Prometheus | End of life: Sep 30, 2026 (six weeks after its Aug 17, 2026 release) |
| Rocket.Chat 8.2 | Rocket.Chat | End of life: Sep 30, 2026 |
| 10 Azure services & APIs | Microsoft | Retirements — the full September table |
| Azure Functions v3 on Linux Consumption | Microsoft | Apps stop running after Sep 30 |
Triage order before September 30
1. Retirements first — they are the only items on the list where something stops working. Export Project Online data, migrate the Azure dependencies, and check for Functions v3 apps on Linux Consumption plans (that one halts applications, not support).
2. The edge platforms second — FortiOS 7.2 and the SonicOS releases are internet-facing firewall software; past end of support, every new vulnerability is permanent, and both platforms carry CISA KEV history. Both are tracked line-by-line on our EOS Edge Device List, alongside the rest of the device class CISA's BOD 26-02 covers.
3. Then the audit — if this list surprised you, others will: paste an inventory into the Stack Scanner, or put your stack on deadline alerts and let the 365/90/60/30/7/0-day warnings do the calendar-watching.
Frequently Asked Questions
What reached end of support or retired on September 30, 2026?
On one day: Microsoft Project Online retired entirely (a Modern Lifecycle retirement - the service stopped); FortiOS 7.2 reached end of support; SonicWall's SonicOS 7.3.0, 7.3.1 and the 7.0.1-5169 maintenance build reached end of support (SonicOS 7.3.2 was listed for the same day until SonicWall re-typed it as a General Release running to February 23, 2027); Zyxel's USG2200 and USG2200-VPN firewall appliances reached end of development, end of vulnerability support, and end of life simultaneously; Cloudera Data Flow 3.0 and Cloudera on cloud 7.2.18 reached end of support; FreeBSD 15.0, Nextcloud 32, Prometheus 3.14 and Rocket.Chat 8.2 reached end of life; and ten Azure services and APIs retired, including Azure Virtual Desktop (Classic), Azure API for FHIR, three generations of Service Bus control-plane APIs, and Track 0/1 Service Bus SDKs. Azure Functions apps still on the v3 runtime in Linux Consumption plans stopped running after the same date.
Why do so many deadlines land on September 30?
Quarter-end and fiscal-year-end gravity — vendors align lifecycle milestones to quarter boundaries, and September 30 closes both Q3 and the US federal fiscal year. The pile-up is accidental, which is why per-product tracking from vendors' own lifecycle pages beats any single roll-up.
Which of these deadlines is hardest?
The retirements — end-of-support software keeps running unpatched, but Project Online stops existing along with access to its data, and retired Azure APIs stop answering. Among the EOS items, FortiOS 7.2 stands out for its exploitation history.
Related
- The EOS Edge Device List — every edge platform's end-of-support status, machine-readable
- Project Online retires September 30 · the Azure September table
- End of support & the CISA BOD 26-02 clock
- The 2026 EOL calendar — the whole year's deadlines