What happens when a commerce platform reaches end of life?

The site keeps running, but the vendor stops releasing security fixes, compatibility updates and support for that version, so new vulnerabilities become your team's responsibility.

Updated

The platform does not switch off, and the store keeps taking orders. What ends is the vendor's support for that version: no new security fixes, no compatibility updates for the PHP, Java or .NET runtime underneath, and no help from the vendor's support desk.

From then on, every new vulnerability is yours to patch, mitigate or accept. For merchants, that also affects PCI DSS v4.0.1 requirement 6.3.3, which expects patches for critical vulnerabilities to be installed within one month of release. With no vendor patches, meeting it relies on workarounds your team builds and maintains.

Most teams use the extended or security-only period, where one exists, as the window to upgrade or migrate. The 2026 dates for SAP Commerce, Adobe Commerce, Drupal, Umbraco, Kentico and Sitecore are in Migrating to composable commerce before your platform reaches end of life.

← Back to Help Center