The Top 50 Products Reaching End of Life in 2026

Every year, dozens of major software products reach end of life. Vendors stop issuing security patches. CVEs accumulate indefinitely. And most organizations only find out when something breaks — or when an attacker finds out first.

2026 is a particularly heavy year for EOL events. Major runtime versions, widely deployed operating systems, core databases, and critical enterprise hardware are all crossing their support thresholds this year. This list covers the 50 most impactful — ranked by deployment breadth and security consequence.

How to Read This List

Each entry shows the product, version, EOL date, and a CVE risk rating based on the product's attack surface, deployment breadth, and historical vulnerability frequency. Critical means this product has been actively exploited in the wild and represents an urgent remediation priority. High means significant exposure with documented CVEs. Medium means lower deployment breadth or lower historical vulnerability frequency.

Part 1 — Already Past EOL in 2026 (Act Now)

These products reached end of life before May 2026. Every day you run them is another day of unpatched CVE exposure. These are not future risks — they are current ones.

Part 2 — Reaching EOL Before End of 2026 (Plan Now)

These products reach end of life between now and December 31, 2026. Migration projects for the items in this section need to be underway now — not started when the date arrives.

Part 3 — Critical Infrastructure EOL (2026 Hardware)

Hardware EOSL has the longest lead times and the highest remediation cost. These items should be in capital planning conversations now.

Part 4 — Watch List: EOL in Early 2027

These products reach EOL in Q1 2027. Migration projects should be scoped and resourced before year-end 2026.

What to Do With This List

Cross-reference every item against your actual production stack. For any match, create a tracked ticket with an owner and a deadline. Don't leave it as a note — it needs to be in your issue tracker, assigned, with a date.

For items already past EOL: These are your immediate priorities. Apply compensating controls — network segmentation, enhanced monitoring, restricted access — while migration is underway. Do not wait for the migration to be complete before implementing controls.

For items EOL within 6 months: Migration projects should already be scoped. If they aren't, start the scoping conversation this week. Six months is enough runway if you start now. Two months is not.

For items EOL in 2027: These belong in your annual planning conversation. Budget and resource them now so there is no scramble when the date arrives.

This list is updated quarterly. For real-time EOL status on any product, use the EOL Checker or browse the Product Index. For your full dependency stack, upload your requirements file to the Stack Scanner.

Data sourced from endoflife.date, NIST NVD, CISA KEV catalog, and official vendor lifecycle pages. How we source data →