The Top 50 Products Reaching End of Life in 2026

The definitive list of software, runtimes, operating systems, databases, and hardware ending support in 2026. For each product: the exact date, the CVE risk level, and what to do about it.

---

Every year, dozens of major software products reach end of life. Vendors stop issuing security patches. CVEs accumulate indefinitely. And most organizations only find out when something breaks — or when an attacker finds out first.

2026 is a particularly heavy year for EOL events. Major runtime versions, widely deployed operating systems, core databases, and critical enterprise hardware are all crossing their support thresholds this year. This list covers the 50 most impactful — ranked by deployment breadth and security consequence.

The CVE blind spot: Products marked Past EOL are no longer receiving security patches. Every CVE disclosed against them after their EOL date accumulates indefinitely. Most vulnerability scanners do not flag this. It is the most underestimated risk in enterprise security.

---

How to Read This List

Each entry shows the product, version, EOL date, and a CVE risk rating based on the product's attack surface, deployment breadth, and historical vulnerability frequency. Critical means this product has been actively exploited in the wild and represents an urgent remediation priority. High means significant exposure with documented CVEs. Medium means lower deployment breadth or lower historical vulnerability frequency.

---

Part 1 — Already Past EOL in 2026 (Act Now)

These products reached end of life before May 2026. Every day you run them is another day of unpatched CVE exposure. These are not future risks — they are current ones.

---

Part 2 — Reaching EOL Before End of 2026 (Plan Now)

These products reach end of life between now and December 31, 2026. Migration projects for the items in this section need to be underway now — not started when the date arrives.

---

Part 3 — Critical Infrastructure EOL (2026 Hardware)

Hardware EOSL has the longest lead times and the highest remediation cost. These items should be in capital planning conversations now.

---

Part 4 — Watch List: EOL in Early 2027

These products reach EOL in Q1 2027. Migration projects should be scoped and resourced before year-end 2026.

---

What to Do With This List

Cross-reference every item against your actual production stack. For any match, create a tracked ticket with an owner and a deadline. Don't leave it as a note — it needs to be in your issue tracker, assigned, with a date.

For items already past EOL: These are your immediate priorities. Apply compensating controls — network segmentation, enhanced monitoring, restricted access — while migration is underway. Do not wait for the migration to be complete before implementing controls.

For items EOL within 6 months: Migration projects should already be scoped. If they aren't, start the scoping conversation this week. Six months is enough runway if you start now. Two months is not.

For items EOL in 2027: These belong in your annual planning conversation. Budget and resource them now so there is no scramble when the date arrives.

The board conversation: This list is the starting point for quantifying EOL risk in terms your board understands. Each item past EOL represents an open vulnerability class with no patch path. The cost to remediate is known. The cost of a breach is estimable. The expected loss calculation belongs in every board risk report.

---

Check Your Stack

This list is a starting point. To see which of these affect your stack specifically, upload your dependency file to the Stack Scanner at endoflife.ai — free, no account required, results in seconds.

You can also check any individual product's full version lifecycle at endoflife.ai — 450+ products covered.

---

Data sourced from endoflife.date, NIST NVD, CISA KEV catalog, and official vendor lifecycle pages. List updated quarterly.

---

Tags: security devops webdev career