Cisco IOS End of Life (EOL) Dates & Support Timeline

Cisco IOS lifecycle status — the real story

Cisco IOS (classic IOS, not IOS XE or IOS XR), the router and switch OS on ISR G2 (800/1900/2900/3900), ISR900, IR800, VG and older Catalyst platforms, modelled per release train from Cisco's own End-of-Sale/End-of-Life bulletins and retirement notices (read 2026-10-09 in a browser, every value read twice). Milestone mapping: support = End of SW Maintenance Releases, eol = End of Vulnerability/Security Support, extendedSupport = Last Date of Support; End-of-Sale and the End-of-Life Announcement date are carried as extra fields where the notice prints them. For the IOS 15 M&T trains 15.3 to 15.9, each row follows the bulletin for the train's (3)M release, which is the train's last and extended maintenance release (15.3(3)M, 15.4(3)M ... 15.9(3)M, shown as the release label); the shorter-lived T releases of each train (for example 15.3(1)T, EOL9066: End of SW Maintenance January 31, 2014, End of Vulnerability/Security Support August 1, 2014, Last Date of Support August 31, 2018) end earlier and devices on them must move to the train's M release to keep fixes. The 15.9(3)M bulletin (EOL15649) lists ISR900 part numbers only; it is the only EoL notice Cisco publishes for the 15.9 train. The 15.8(3)M bulletin prints the same date for maintenance and security support (December 14, 2022).

Trains 15.2 (15.2M&T), 15.0 (15.0M), 12.4 Mainline, 12.4T, 12.3 Mainline, 12.3T, 12.2 Mainline and 12.2T have no readable bulletin on cisco.com; Cisco's retirement notice for each prints only an End-of-Sale Date (none for 12.4 and 12.4T) and an End-of-Support Date. The End-of-Support Date is carried as extendedSupport (on the 15.4M&T notice it equals the 15.4(3)M bulletin's Last Date of Support, February 28, 2022); support is false and eol is true because that date has passed, and no maintenance or security date is filled. The 12.1E bulletin (EOL5088, 2006) prints no security-support milestone, so eol is true (its Last Date of Support, March 15, 2012, has passed). No retirement notice or bulletin was found for 15.1M&T.

Not modelled: the switch trains 15.0SE and 15.2E and the Catalyst 6500/6800 SY trains. Cisco ends those per rebuild and per platform family (for example 15.2(2)E, 15.2(5)E and 15.2(6)E for Catalyst 2960/3560/4900 in joint IOS XE bulletins, 15.2(7)E for Industrial IoT switches), so no single train date exists; the 15.4(1)SY bulletin now redirects to an index page. Cisco's support pages for 15.0SE and 15.2E print End-of-Sale 14-AUG-2020 and End-of-Support 31-AUG-2025.

Release dates are not stated in the bulletins, so releaseDate is null on every line. Cisco's support series pages print a Series Release Date for some trains (15.9M&T 31-JUL-2019, 15.3M&T 28-NOV-2012); those pages are not used for any date here because the 15.3M&T series page prints an End-of-Support Date (31-OCT-2024) that belongs to a later train filed under the same listing.

KEV context (CISA catalog 2026.10.08): CISA files classic IOS flaws under the product strings 'IOS', 'IOS Software' and 'IOS software' (12 entries, newest CVE-2008-4128 added 2026-07-13), and files flaws that affect both classic IOS and IOS XE jointly under 'IOS and IOS XE', 'IOS and IOS XE Software', 'IOS Software and Cisco IOS XE Software', 'IOS, IOS XR, and IOS XE' and 'IOS, XR, and XE Software' (24 entries). IOS XE and IOS XR are separate products with their own pages.

Verification: cisco.com is bot-blocked for plain fetches (Akamai), so this file is a frozen manual read; each line links its own bulletin or retirement notice and the 15.3M&T, 15.6M&T, 15.8M&T and 15.9M&T notice listings are the index to re-read.

Cisco IOS release and support pattern

Of the 16 release lines tracked, 15 are past end of life and 1 is still within support; 9 are marked end of life without a published date. The next scheduled end of life is 15.9 on July 27, 2029 — 1020 days from this build. Upstream also publishes an extended-support phase for 16 lines, shown in the table above.

Computed from the tracked release data at every build — the figures above are the dates in the table, restated, not an editorial estimate.

Cisco IOS security intelligence

CISA KEV history: Cisco IOS is named in CISA's Known Exploited Vulnerabilities catalog 36 times, most recently on 2026-07-13. Derived from CISA's live catalog at every build.

What does Cisco IOS end of life mean for your organization?

When a version of Cisco IOS reaches end of life, the maintainers stop issuing security patches. Vulnerabilities discovered after this date are publicly disclosed on the National Vulnerability Database, exploit code appears on GitHub, and your systems remain permanently exposed.

The CVE blind spot: A CVE-based scan does not show the accumulation of unpatched vulnerabilities in EOL software. Some scanners flag unsupported versions of common products, but coverage varies, and none of them give you the date in advance. With a zero-day, nobody knows about the vulnerability. With EOL software, the vulnerability is public — listed, rated, and often weaponized — but no vendor patch is coming. This is one of the most dangerous gaps in enterprise security posture.

Organizations running EOL Cisco IOS should treat it as a vulnerability class in their risk register, apply compensating controls (network segmentation, enhanced monitoring, access restriction), and prioritize migration to a supported version.

Your options when Cisco IOS reaches end of life

There are four realistic paths. Which one is right depends far more on how long the system needs to keep running than on the version you are on today.

How to choose, in one question: how many more years does this system need to run? Under a year, extended support (where it exists) is usually cheaper than an emergency migration. One to three years, migrate — support purchased repeatedly costs more than doing the project once, and the project only gets harder as the version ages. Indefinitely, migrate now and plan the next migration before it surprises you.

Worth saying plainly, because vendors selling extended support rarely will: extended support is often the more expensive choice over a multi-year horizon. It is the right answer when a deadline is genuinely unreachable, not as a default. Compare the annual fee against the one-time cost of migrating before committing to either.

Formalizing decisions like this across your estate? Our free EOL policy template is a ready-to-adopt policy with risk tiers, remediation SLAs, and audit mapping — no signup, free to use and share.

Extended Support Options

If you cannot migrate immediately, extended support vendors provide continued security patches for EOL Cisco IOS versions. This is a bridge, not a permanent solution — plan your migration in parallel.

Related Products