Kentico 13 End of Support: Your Options Before December 31, 2026

On January 1, 2027, a Kentico Xperience 13 site keeps working. What stops is everything behind it. Kentico's support lifecycle says it will "cease all support, maintenance, updates, releases, hotfixes, patches, repairs (including security repairs)" for Xperience 13, and that running it after December 31, 2026 is at the customer's "sole risk." Kentico doesn't offer extended support.

There's an earlier date most teams miss. Kentico's own release notes warn that ".NET 8 and .NET 9 reach Microsoft's planned end of support on November 10, 2026." If your live site still runs on .NET 8, it stops getting Microsoft's security patches seven weeks before Kentico's deadline, whatever you decide about the CMS.

So the real question isn't whether to act. It's which of five paths fits your site, your team, and the time you have left.

The dates that matter

If you're still on Kentico 12 or older, you're already past the end of support. Everything below still applies, and Kentico's migration tool accepts Kentico 11 and 12 as sources too.

What "unsupported" means for a Kentico 13 site

It's easy to treat an end-of-support date as paperwork. The record for Xperience 13 says otherwise.

Kentico 13 has already been attacked. In early 2025, researchers at watchTowr found a chain of flaws in the Staging Service that let an attacker bypass sign-in and, combined with a second flaw, run code on the server. Kentico fixed them in hotfixes 13.0.173 and 13.0.178. The US Cybersecurity and Infrastructure Security Agency (CISA) added two of them, CVE-2025-2746 and CVE-2025-2747, to its catalog of vulnerabilities known to be exploited in real attacks on October 20, 2025, and added a third, CVE-2025-2749, on April 20, 2026. The Staging Service is off by default, so the sites at risk were the ones that use it to sync content between environments.

New flaws keep being found. Kentico's security feed for Xperience 13 lists 38 security entries from January to October 2026 alone. Most are updated third-party libraries, but they include a Form Builder SQL injection rated Critical (fixed in 13.0.212 on July 22, 2026) and an authorization flaw and an account-recovery flaw in September (both fixed in 13.0.216). After December 31, problems like these stay open.

Compliance frameworks name supported software directly.

• UK Cyber Essentials (version 3.3, April 2026) requires that all in-scope software "be licensed and supported" and "be removed from devices when it becomes unsupported." It defines supported software as software a vendor has committed to fix, and treats publicly available commercial web applications as in scope by default.
• PCI DSS says patches for critical vulnerabilities "must be resolved within one month of release" (PCI SSC FAQ 1597). With no vendor patches, there's nothing to apply.
• HIPAA requires covered organizations to assess "the potential risks and vulnerabilities" and reduce them "to a reasonable and appropriate level" (45 CFR 164.308). An unpatchable CMS is hard to defend in that assessment.

Kentico's lifecycle page also says its liability for Xperience 13 "will terminate on December 31, 2026." For credit unions, healthcare groups, schools, and anyone who answers a cyber insurance questionnaire, that's often what forces the decision.

Option 1: Stay on Kentico 13 for now

Whatever you choose, do these this month:

• Install the latest hotfix. At the time of writing that's 13.0.218 (October 22, 2026). Kentico releases hotfixes most Thursdays, and every 2026 security fix ships this way.
• Move the live site to .NET 10. Kentico added .NET 10 support in Refresh 14 (December 4, 2025) and tells customers to "migrate to .NET 10." Microsoft supports .NET 10 until November 14, 2028, so this closes the platform gap even after Kentico's own support ends.
• Turn off the Staging Service if you don't use it, and limit admin access to known networks.

This keeps the site patched through December and on a supported .NET version afterwards. It doesn't fix Kentico itself after December 31, so treat it as time to migrate, not as a destination.

Option 2: Upgrade to Xperience by Kentico

Xperience by Kentico is Kentico's current product, and it's the path Kentico recommends. It's also the one most often misunderstood: Kentico's upgrade FAQ says plainly that "XbyK is a new product, not a direct continuation of KX13." Treat it as a rebuild on a new platform, not a version update.

What Kentico's migration tool moves. The open-source Kentico Migration Tool moves sites, page types, pages and attachments, media libraries, forms and their submissions, contacts and activities, consents, custom tables, admin users and roles, and members. It supports Xperience 13 (Refresh 5 or newer), Kentico 12, and Kentico 11 as sources.

What it doesn't move. "Code migration is not supported," so your widgets, page templates, and custom modules have to be rewritten. It also doesn't move page permissions, role permissions, or member passwords, and every user, editors included, has to set a new password.

Where the effort goes. Kentico rates the work by feature:

• Page Builder widgets: low to medium ("the widget code needs minor adjustments").
• Custom modules: medium ("developers need to re-implement the UI").
• Marketing automation: high ("the automation processes have to be set up from scratch").

Kentico also offers KentiCopilot, an AI-assisted tool that converts controllers, views, and widgets, with output your developers still review.

Cost and timeline. Kentico licenses Xperience by Kentico by channel, in Standard and Advanced tiers, hosted by Kentico (SaaS) or in your own cloud. It doesn't publish list prices. For the project itself:

• Kentico's upgrade FAQ: "It's not possible to provide a universal estimate for timeline or costs."
• Kentico's blog on 2026 CMS migrations: a straightforward migration "typically takes 3-4 months with an experienced team."
• BizStream, a Kentico partner (October 2025): "Simpler sites may budget in the tens of thousands," while "highly customized enterprise implementations can reach six figures."

Who it suits. Teams that rely on Kentico's personalization, contact scoring, or marketing automation, have .NET developers, and want to stay with one vendor. If those features are why you bought Kentico, this is usually the right call, even though it's a rebuild.

Option 3: Move to Umbraco 17

Umbraco is an open-source .NET CMS, and a common choice for teams that want to keep their .NET skills without a license fee.

• Pick Umbraco 17, not 13. Umbraco 13 loses support on December 14, 2026, two weeks before Kentico 13. Umbraco 17 is the current long-term support version, supported until November 27, 2028.
• Cost. The core is free. Umbraco Cloud hosting starts at €45 a month (Starter), €280 (Standard), and €730 (Professional).
• Timeline. UKAD, an Umbraco agency that migrates Kentico sites, says that on average its Umbraco migration projects "are completed within 6 to 12 weeks."

It's a rebuild too: templates and custom code are rewritten for Umbraco, and you lose Kentico's built-in marketing features. We don't offer Umbraco migrations, but for a .NET team that mainly wants a stable CMS without a license, it deserves a serious look.

Option 4: Move to WordPress

WordPress runs 39.5% of all websites and has 58.2% of the CMS market (W3Techs, November 2, 2026). For a marketing or content site, that size means no license fee, a much larger pool of developers and agencies, and an editor many marketers already know. Kentico's Page Builder sections become WordPress blocks, so editors keep building pages from sections.

Where Kentico moves go wrong. The risks are specific to how Kentico handles addresses:

• File links: Kentico serves files through /getmedia/ and /getattachment/ addresses with long IDs. PDFs and images linked from other sites still use them, and each needs a redirect.
• Former URLs: Kentico quietly redirects old addresses after a page is renamed or moved. Those redirects vanish with Kentico unless they're exported and carried over.
• Language versions: each one has its own addresses and must map to the same structure, or each language loses rankings separately.
• Passwords and contacts: WordPress can't read Kentico passwords, so users reset them at launch. Kentico's contact profiles and activity have no WordPress equivalent and usually move to your CRM.

Cost. Our Kentico to WordPress migrations start at $7,500 for sites under 50 pages and run $12,000–$25,000 for 50–300 pages, typically in 6–10 weeks, with a quote before work begins.

Who it suits. Organizations whose site is mainly content (credit unions, healthcare groups, associations, schools) and whose editors want a simpler CMS. It's a weak fit if you depend on Kentico's personalization or contact scoring and want those inside the CMS. See Kentico to WordPress migration for what moves and how pricing works.

Option 5: Move to Next.js with a headless CMS

For teams with developers, a Next.js front end with a headless CMS such as Sanity or Payload gives you a React codebase you own, fast pages, and a clean way to pull in data from other systems, such as rates, locations, or account tools. Editors work in the CMS. Developers own the code.

Xperience by Kentico can run headless too, through a GraphQL API, but Kentico's documentation says those features "require the Xperience by Kentico Advanced license tier."

Cost. Our Kentico to Next.js migrations start at $9,500, including the CMS setup, typically in 6–10 weeks. Who it suits: teams with developers who'll own the codebase after launch. If nobody on your team would, WordPress is the simpler move. See Kentico to Next.js migration.

Which path fits

Two questions settle most decisions. First, which Kentico features would you genuinely miss? Write that list down before you talk to any vendor, including us. Second, who will own the site after launch: a .NET team, a marketing team, or a JavaScript team?

A realistic timeline from here

• This week: install the latest hotfix, plan the move to .NET 10, and list your forms, integrations, languages, and any custom modules.
• Before December: pull every URL from your sitemap, Search Console, analytics, and backlinks, including /getmedia/ file links and Former URLs. Whichever path you pick, you'll need this list.
• By the end of November: choose a path and get quotes. Small sites (under about 50 pages) can often launch around the deadline. Larger sites should plan an early-2027 launch, with Option 1 in place until then.
• Before launch: test every redirect, form, and integration in staging. The CMS migration checklist and website migration SEO checklist cover both.

Missing December 31 by a few weeks on a fully patched site running .NET 10 is a known, limited risk. A rushed migration that drops redirects and loses search traffic can cost more.

How we researched this

We checked every date, figure, and quote on November 2, 2026, against the primary sources listed below: Kentico's support lifecycle, upgrade FAQ, documentation, release notes, and security feed; Microsoft's .NET support policy; CISA's vulnerability catalog; the NCSC's Cyber Essentials requirements; the PCI Security Standards Council; the US Code of Federal Regulations; W3Techs; and Umbraco. Where a figure comes from a company that sells one of these paths, we name the company and date.

Valiance Labs sells Kentico to WordPress and Kentico to Next.js migrations. We don't sell Xperience by Kentico upgrades or Umbraco migrations, and we've described both as fairly as the paths we offer.