Umbraco 13 EOL: the real risks after December 14, 2026

On December 14, 2026, Umbraco 13 reaches end of life. Your website will keep running afterward, but Umbraco HQ stops shipping security updates, bug fixes, patches and support. From that day on, every newly discovered vulnerability stays open, and nobody is going to close it.

That sounds like a problem for later, but it's September, three months before the deadline. An upgrade or migration takes more time than most organizations plan for.

You've probably already come across a blog about why you should upgrade. This article covers something different: what actually goes wrong after December 14 if you stay on Umbraco 13, so you know which risk you're carrying and what you can still do about it.

What does Umbraco end of life actually mean?

End of life means Umbraco HQ stops maintaining that version. That means no more updates, no technical support and, most important of all, no more security patches.

Your site won't collapse on December 14. It keeps doing what it did before. The risk isn't in today, it's in everything that gets discovered afterward.

You're also further along than you might think. Umbraco 13 has been in its security-only phase since December 2025, so you've now gone almost a year without bug fixes. After December 14, the security patches stop too, and that's the end of the road.

What goes wrong after December 14

No more security patches

This is the core of the problem. As long as a version is supported, Umbraco closes vulnerabilities as soon as they become known. After the end-of-life date, that stops.

Vulnerabilities often come to light after EOL. Attackers know exactly which versions no longer get patches and go looking for them. A known, unpatched vulnerability in a popular CMS is about the easiest way in there is.

The foundation under your site expires even earlier

Umbraco 13 runs on .NET 8, and Microsoft ends support for .NET 8 on November 10, 2026, before Umbraco's own deadline.

That leaves not just the CMS but the technical layer underneath it unprotected. Keep in mind that extended support for Umbraco (XLTS, which we'll get to in a moment) does not cover the .NET layer.

A data breach immediately becomes a GDPR problem

Your site holds personal data: form submissions, newsletter signups, maybe a client portal or account details. If that runs on software that no longer gets patches, a data breach stops being an "if" and becomes a "when."

And a breach isn't just an IT incident. Under the GDPR, you have to report a breach to the data protection authority (in the Netherlands, the Autoriteit Persoonsgegevens) and sometimes to the people affected as well. The GDPR also requires appropriate technical measures (Article 32). If you knowingly keep running a CMS that no longer receives security updates, it's hard to defend that as "appropriate," and it's the kind of thing your executive team will ask you about.

Compliance, audits and your cyber insurance

More and more organizations work under requirements that call for supported software, whether that's a cyber insurance policy, an ISO certification or a security audit from a large client.

If you run an EOL version, you can easily fall out of compliance. In the worst case, your insurer won't pay out after an incident, right when you need the coverage most.

Integrations that quietly stop working

Your website doesn't stand on its own. It's connected to your marketing stack, forms, analytics and maybe a CRM. After EOL, Umbraco HQ no longer guarantees that version 13 will keep working smoothly with the rest of your environment.

This rarely happens with a bang. It's more likely a form that suddenly stops submitting, or an integration that goes silent after an update on the other end. Small, but exactly the kind of problem that lands on your desk.

"But my site still works, doesn't it?"

It does, and that's exactly why EOL is so easy to ignore. You've probably run outdated software before without anything going wrong.

The difference is that this risk stays invisible until something happens. A site that looks perfectly fine can have an open vulnerability for months. You only notice when someone exploits it, and by then it's too late to fix it calmly.

Upgrade: an opportunity, not a cost

So far, this article has been about what you lose if you stay put. But an upgrade is about more than buying down risk. You also move to a platform that does a lot more for you than your Umbraco 13 site can today. Here are a few things that come within reach:

A backoffice that actually helps your team. Since version 14, the entire backoffice has been rebuilt. It's faster, more modern and designed so your team can do more on its own without needing a developer for every change. For you as the person ultimately responsible, that means less waiting and faster turnaround.

AI in the CMS, with you holding the reins. With Umbraco.AI, Umbraco has laid a foundation for AI in the backoffice, where you decide which model, which tone of voice and which rules apply before AI touches anything. On top of that come practical helpers: writing and rewriting copy, translating, and generating SEO metadata and alt text, always with a human making the final call. That means more content on more channels without giving up quality or brand consistency.

Automating recurring work. Umbraco is working on automated content workflows: chains of AI actions and rules you can link together for work that repeats. Think of preparing variants, cleaning up metadata or keeping a large number of pages consistent.

Getting more out of your visitors. On a current platform, you can use the full Umbraco ecosystem, such as Umbraco Engage for analytics, A/B testing and personalization. That's the toolset for seeing what works and improving your conversion, straight from the backoffice.

Underneath all of this sits .NET 10, which brings better performance and scalability, and in version 17 the backoffice can even run across multiple servers. So you're not just solving a problem, you're taking a step forward.

What you can do now, with three months to go

Broadly speaking, you have three options.

Upgrade to Umbraco 17. This is the current LTS version. It runs on .NET 10 and is supported until the end of 2028. For most sites, it's the logical step: you keep your content, your team stays in a familiar environment and you're covered for years. You also get something in return. Everything added since version 14, including the new AI capabilities in the CMS, stays out of reach as long as you're on 13. So an upgrade isn't only about removing risk, it also lets you move forward again. To be honest, though, going from 13 to 17 is a real upgrade, not an update button. Since version 14, Umbraco has a completely new backoffice and the old editors have been replaced. Custom code, packages and integrations all need to be reviewed one by one. That's why three months is tight. Starting now is the difference between planning calmly and scrambling later at emergency rates.

XLTS as an emergency brake. If you can't finish the upgrade before December 14, Umbraco offers Extended Long-Term Support. For a fee, you keep receiving security patches in blocks of 6, 12 or 24 months. It buys you time to plan properly, but it only postpones the problem and doesn't solve it. It also doesn't cover the .NET layer.

Switch agencies. If you're stuck with an agency that's slow to respond or leaves you on your own with this deadline, now is the time to switch. An EOL deadline is the worst moment to depend on a partner who doesn't pick up the phone.

What we would do

Start by finding out where you stand. Which version are you running exactly, which integrations and custom modules depend on it, and how big is the step to 17 realistically? Without that picture, any estimate is a guess.

As an Umbraco Gold Partner, we run this kind of scan regularly. We look at your current Umbraco 13 site, map out the upgrade or migration and tell you honestly what we find, even if that means XLTS is the sensible choice for now. And if you're currently with an agency that isn't picking up, we'll handle the switch with as little hassle for you as possible.

Three months is tight for a migration. Have your Umbraco 13 site reviewed while you can still choose calmly.