Multiple critical Microsoft development frameworks reach end of support simultaneously on 10 November 2026 – the same Patch Tuesday that marks the final security update for Windows 11 version 23H2 Enterprise and Education editions.
According to Microsoft’s October 2026 Patch Tuesday lifecycle documentation, .NET 8, .NET 9, PowerShell 7.4 and PowerShell 7.5 all reach end of support on 10 November 2026
. For Kent SMEs running web applications, automation scripts, scheduled tasks and internal tools built on these frameworks, this creates an urgent requirement to upgrade or face ongoing security vulnerabilities without patches.
The timing is particularly significant because these developer tools and scripting platforms often run behind the scenes, powering business-critical applications that many organisations may not immediately associate with Microsoft’s support lifecycle. Unlike desktop operating systems that prompt users to upgrade, these frameworks continue operating silently after end of support – but without receiving security fixes for newly discovered vulnerabilities.
What Ends Support on 10 November 2026
The November 2026 Patch Tuesday sees .NET 8 and .NET 9 reach end of support, alongside PowerShell 7.4 and 7.5, with Windows 11 Enterprise and Education 23H2 receiving its last update on the same date
. This simultaneous end-of-life across multiple product lines creates compounded risk for businesses that have not yet planned their upgrade paths.
The affected frameworks include:
- .NET 8: Released November 2023, this framework supports ASP.NET Core web applications, Blazor, APIs and Windows desktop applications across millions of business systems
- .NET 9: Despite being a more recent release, this version follows Microsoft’s pattern of short-term support releases that receive only 18 months of security updates
- PowerShell 7.4 and 7.5: Cross-platform automation frameworks widely used for scheduled tasks, server management scripts, Azure automation and system administration workflows
For Kent businesses, the immediate concern is identifying where these frameworks are deployed. Unlike visible desktop applications, .NET and PowerShell dependencies often exist within custom-built tools, third-party business applications, automated backup scripts and server management routines that IT teams may not have documented comprehensively.
Why .NET and PowerShell End of Support Creates Security Risk
The security implications extend beyond the frameworks themselves.
CVE-2026-105016, a critical remote code execution flaw in Microsoft QUIC, affects .NET 8, 9, 10 and 11 on Windows as well as Visual Studio 2022 and 2026, requiring no authentication or user interaction
. This type of vulnerability demonstrates how framework-level flaws can expose entire applications to attack, regardless of how well the business application code itself has been written.
After 10 November 2026, any newly discovered vulnerabilities in .NET 8, .NET 9, PowerShell 7.4 or PowerShell 7.5 will not receive security patches. Applications and scripts running on these unsupported frameworks will remain vulnerable to:
- Remote code execution exploits that allow attackers to run malicious code on servers hosting .NET applications
- Privilege escalation vulnerabilities in PowerShell that could allow attackers to gain administrator access through compromised scripts
- Data exposure flaws in web applications built on outdated ASP.NET Core versions
- Supply chain attacks targeting known vulnerabilities in unsupported framework versions
The record 203,585 cyberattack attempts that UK businesses faced in Q3 2026 demonstrates that attackers actively exploit known vulnerabilities. Unsupported frameworks provide documented attack surfaces that malicious actors can target systematically.
The Automation Risk That Businesses Overlook
PowerShell end of support presents a particularly hidden risk. Many Kent SMEs rely on PowerShell scripts for critical business functions including scheduled backups, user account provisioning, server health monitoring, Microsoft 365 administration and automated reporting. These scripts often run under service accounts with elevated privileges, making them high-value targets for attackers.
Unlike desktop applications that users interact with daily, PowerShell scripts may execute successfully for months or years after framework support ends. The absence of visible errors creates false confidence, whilst unpatched vulnerabilities accumulate. When businesses discover their automation relies on unsupported PowerShell versions during security audits or after incidents, remediation becomes urgent and expensive.
What Kent SMEs Must Do Before 10 November 2026
Businesses have eight days remaining until this critical support deadline. The following actions should be prioritised immediately:
1. Audit All .NET and PowerShell Deployments
Identify every system, application and script that depends on .NET 8, .NET 9, PowerShell 7.4 or PowerShell 7.5:
- Check web servers running ASP.NET Core applications for framework versions
- Review custom-built internal applications and their .NET dependencies
- Audit all PowerShell scripts in scheduled tasks, Group Policy startup scripts and server management routines
- Document third-party business applications that may bundle specific .NET runtime versions
- Test desktop applications built on Windows Presentation Foundation (WPF) or Windows Forms that target these framework versions
Many businesses discover during this audit that they have more .NET and PowerShell dependencies than initially documented, particularly in servers inherited from previous IT providers or built by staff members who have since left.
2. Plan Migration to Supported Versions
Microsoft’s current long-term support (LTS) release is .NET 10, whilst PowerShell 7.6 remains supported beyond November 2026. Migration paths include:
- For .NET applications: Upgrade to .NET 10 LTS, which receives support until November 2027, providing 12 months of additional security coverage
- For PowerShell scripts: Test scripts against PowerShell 7.6 or later versions, addressing any compatibility issues before deployment
- For third-party applications: Contact software vendors to confirm their upgrade paths and whether newer versions support current .NET LTS releases
The Windows 11 23H2 Enterprise and Education end of support on the same date compounds this deadline pressure, as many organisations face simultaneous operating system and framework upgrades.
3. Test Applications Before Deadline
Framework upgrades occasionally introduce breaking changes that affect application behaviour. Testing should include:
- Functional testing of all business-critical applications after .NET runtime upgrades
- PowerShell script validation to ensure cmdlets and syntax remain compatible with newer versions
- Performance testing to identify any degradation introduced by framework updates
- Security testing to confirm authentication, authorisation and data protection mechanisms function correctly post-upgrade
Businesses should prioritise testing in non-production environments before deploying framework upgrades to live systems, particularly for customer-facing web applications and financially significant automation scripts.
4. Document Framework Versions Across Your Estate
Create a maintained inventory of framework versions deployed across all systems. This documentation supports:
- Future lifecycle planning as newer .NET and PowerShell versions reach end of support
- Security audits and compliance assessments that require evidence of supported software versions
- Incident response when vulnerabilities are announced, enabling rapid identification of affected systems
- Third-party security assessments, particularly for organisations pursuing Cyber Essentials certification
The Broader Pattern: Microsoft’s Faster Release Cadence
The simultaneous end of support for multiple framework versions reflects Microsoft’s accelerated release cycle.
Microsoft is rolling out Windows 11 builds 26300.9818 and 26200.9818 as the first non-security preview for the November 2026 Security Update, with changes currently being tested before the following month’s Patch Tuesday update
.
This faster cadence creates more frequent upgrade obligations for businesses. Organisations that previously planned major updates every 3–5 years now face annual or biennial framework migrations to remain within supported versions. The administrative overhead and testing burden has increased correspondingly.
For Kent SMEs without dedicated development teams, this creates particular challenges. Many businesses built applications on .NET Framework (the older, Windows-only version) specifically because of its long-term support guarantees. The shift to .NET Core and its successor .NET 5+ with shorter support windows requires more proactive lifecycle management.
What Happens After 10 November 2026
Systems running unsupported .NET and PowerShell versions will continue functioning normally – at first. The immediate impact is the absence of future security patches. As new vulnerabilities are discovered and disclosed publicly, attackers will develop exploits targeting these known weaknesses.
The timeline for exploitation varies, but history suggests high-value targets face attacks within weeks of vulnerability disclosure. The phishing attacks that dominated 83% of UK SME cyber incidents in October 2026 often serve as the initial access vector, with attackers then exploiting framework vulnerabilities to escalate privileges and move laterally through networks.
Businesses maintaining unsupported frameworks also face:
- Compliance failures: Cyber insurance policies and industry standards increasingly require organisations to run supported software versions
- Audit findings: Internal and external security audits will flag unsupported frameworks as critical vulnerabilities
- Customer trust damage: Data breaches traced to known, unpatched vulnerabilities in outdated frameworks cause reputational harm
- Regulatory scrutiny: The UK’s evolving cyber resilience requirements may impose reporting obligations when incidents result from unsupported software
Additional Resources for Kent Businesses
Microsoft provides guidance on framework migration through its official documentation. The porting guide for .NET includes compatibility analysers and migration strategies for complex applications.
For PowerShell migrations, Microsoft’s PowerShell 7 migration documentation addresses the most common compatibility issues businesses encounter when upgrading scripts from Windows PowerShell 5.1 or earlier PowerShell Core versions.
Businesses should also review their broader patch management practices. The record 1,411 vulnerabilities Microsoft patched in October 2026 demonstrates the volume of security updates organisations must manage across their entire IT estate.
Get Expert Support for Framework Migration and Lifecycle Management
With eight days remaining until .NET 8, .NET 9, PowerShell 7.4 and PowerShell 7.5 reach end of support, Kent businesses must act immediately to audit dependencies, test upgrades and migrate to supported versions. The simultaneous end of support for multiple frameworks compounds the urgency and technical complexity.
Meridian Micro Limited provides comprehensive support for framework lifecycle management, including dependency auditing, migration planning, application testing and ongoing patch management across your entire IT estate. Our team ensures your business-critical applications and automation scripts remain secure and supported as Microsoft’s release cadence accelerates.
Contact us today on 01303 883111 to discuss your framework upgrade requirements and ensure your Kent business maintains security protection beyond the 10 November 2026 deadline. We’ll help you identify all affected systems, plan migration paths and implement upgrades with minimal disruption to business operations.