Microsoft .NET 8 and .NET 9 support end poses risks for German authorities

Microsoft is scheduled to end security updates for .NET 8 and .NET 9 on November 10, 2026. This deadline presents significant challenges for public administration in Germany, where many specialized applications are managed by state data centers and municipal IT service providers.

Because many of these applications are developed by external vendors, the transition to newer versions like .NET 10 depends on third-party software releases. Until such updates are available, applications will run without security patches, creating potential vulnerabilities.

To comply with BSI IT-Grundschutz standards and the NIS2 Implementation Act, which mandates enhanced risk management for federal administration, authorities must document and take responsibility for any remaining risks associated with unsupported software.