Legacy Technology Tracker

Name: Legacy Technology Tracker
Creator: Software Modernization Intelligence
License: https://creativecommons.org/licenses/by/4.0/

Support status, end-of-life dates, actively exploited vulnerabilities and evidence of continued use for 35 legacy technologies that organisations still run. Every value links to its source and shows the date we checked it.

Status as of 16 Oct 2026. Data checked 7 Oct 2026; refreshed monthly, with quarterly snapshots kept unchanged. Methodology

How to use this tracker

Sort by risk or key date to see what has already lost support and what loses it next. Filter by risk level or support status.
Open a technology for its fact sheet: each date with its source, extended-support options, exploited vulnerabilities, usage, and what to do if you still run it.
Download the table as CSV or JSON to reuse it. Credit Software Modernization Intelligence and link to this page.

All tracked technologies

Risk

Status

Showing 35 of 35

Legacy technologies by support status, key date, risk rating, CISA KEV count and usage. Status as of 16 Oct 2026; data checked 7 Oct 2026.
	Support status					Last checked
Adobe Flash PlayerWeb platform	Unsupported	Ended 31 Dec 20205 years and 9 months ago	High High: support ended 31 Dec 2020; 36 vulnerabilities on CISA's KEV list.	360 in last 24 months	5,680home pages, 0.064% of crawl, Aug 2026Adobe Flash, all versions	7 Oct 2026
Microsoft SilverlightWeb platform	Unsupported	Ended 12 Oct 20215 years ago	High High: support ended 12 Oct 2021; 3 vulnerabilities on CISA's KEV list.	30 in last 24 months	No usage data	7 Oct 2026
CentOS Linux 7Infrastructure	Unsupported	Ended 30 Jun 20242 years and 3 months ago	High High: support ended 30 Jun 2024; no releases since support ended.	Not tracked	24,759home pages, 0.28% of crawl, Aug 2026CentOS, all versions	7 Oct 2026
Drupal 7Web platform	Unsupported	Ended 5 Jan 202521 months ago	High High: support ended 5 Jan 2025; 6 vulnerabilities on CISA's KEV list; no releases since support ended.	61 in last 24 months	16,397home pages, 0.18% of crawl, Aug 2026In-scope versions only	7 Oct 2026
SharePoint Server 2016 and 2019Enterprise server	Unsupported	Ended 14 Jul 20263 months ago	High High: support ended 14 Jul 2026; 17 vulnerabilities on CISA's KEV list.	1712 in last 24 months	2,138home pages, 0.024% of crawl, Aug 2026Microsoft SharePoint, all versions	7 Oct 2026
Exchange Server 2016 and 2019Enterprise server	Paid extended support only	Paid support ends 31 Oct 2026in less than a month	High High: paid extended support ends 31 Oct 2026; 19 vulnerabilities on CISA's KEV list.	192 in last 24 months	No usage data	7 Oct 2026
Windows Server 2012 and 2012 R2Infrastructure	Unsupported	Ended 13 Oct 2026less than a month ago	High High: support ended 13 Oct 2026; 208 vulnerabilities on CISA's KEV list.	20836 in last 24 months	No usage data	7 Oct 2026
SQL Server 2014Database	Paid extended support only	Paid support ends 12 Jul 2027in 8 months	High High: paid extended support ends 12 Jul 2027; 2 vulnerabilities on CISA's KEV list.	21 in last 24 months	No usage data	7 Oct 2026
Visual Basic 6.0Application platform	Unsupported	Ended 8 Apr 200818 years and 6 months ago	Elevated Elevated: support ended 8 Apr 2008; no entries on CISA's KEV list.	00 in last 24 months	No usage data	7 Oct 2026
Magento 1Web platform	Unsupported	Ended 30 Jun 20206 years and 3 months ago	Elevated Elevated: support ended 30 Jun 2020; no entries on CISA's KEV list.	00 in last 24 months	861home pages, 0.0097% of crawl, Aug 2026In-scope versions only	7 Oct 2026
AngularJSFramework or library	Unsupported	Ended 31 Dec 20214 years and 9 months ago	Elevated Elevated: support ended 31 Dec 2021; no entries on CISA's KEV list.	00 in last 24 months	80,621home pages, 0.91% of crawl, Aug 2026AngularJS, all versions	7 Oct 2026
Windows Server 2016Infrastructure	Supported	Supported until 12 Jan 2027in 2 months	Elevated Elevated: support ends 12 Jan 2027.	18739 in last 24 months	No usage data	7 Oct 2026
Windows 10Infrastructure	Paid extended support only	Paid support ends 10 Oct 2028in 23 months	Elevated Elevated: standard support ended 14 Oct 2025; paid extended support runs to 10 Oct 2028; 97 vulnerabilities on CISA's KEV list.	9740 in last 24 months	No usage data	7 Oct 2026
SQL Server 2016Database	Paid extended support only	Paid support ends 17 Jul 2029in 2 years and 9 months	Elevated Elevated: standard support ended 14 Jul 2026; paid extended support runs to 17 Jul 2029; 1 vulnerability on CISA's KEV list.	10 in last 24 months	No usage data	7 Oct 2026
Microsoft BizTalk ServerEnterprise server · Covered in our full guide	Supported	Supported until 9 Apr 2030in 3 years and 5 months	Watch Watch: supported until 9 Apr 2030; end of sale announced 31 Aug 2026: Microsoft announced that BizTalk Server 2020 is the final release and that it expects sales of BizTalk Server 2020 and Host Integration Server 2020 to end on 31 March 2027. Existing licensed deployments may continue to be used under their licence terms.	00 in last 24 months	No usage data	7 Oct 2026
RedisDatabase	Supported	New versions continue	Watch Watch: supported, with new release lines continuing; licence change 1 May 2025: Redis 8 added the OSI-approved AGPLv3 as a third licensing option alongside RSALv2 and SSPLv1.	10 in last 24 months	No usage data	7 Oct 2026
Java EE (WebLogic)Application platform	Supported	Supported until Dec 2030in 4 years and 2 months	Low Low: supported until Dec 2030; no licence change recorded in the last 24 months; 12 vulnerabilities on CISA's KEV list (supported versions receive security fixes).	122 in last 24 months	No usage data	7 Oct 2026
.NET FrameworkLanguage and runtime	Supported	No end date announced	Low Low: supported with no end date announced; no licence change recorded in the last 24 months; 4 vulnerabilities on CISA's KEV list (supported versions receive security fixes).	41 in last 24 months	No usage data	7 Oct 2026
Active Directory (on-premises)Enterprise server	Supported	Newest version supported until 14 Nov 2034	Low Low: supported, with new release lines continuing; no licence change recorded in the last 24 months; 3 vulnerabilities on CISA's KEV list (supported versions receive security fixes).	30 in last 24 months	No usage data	7 Oct 2026
Adobe ColdFusionApplication platform	Supported	Newest version supported until 26 Feb 2030	Low Low: supported, with new release lines continuing; no licence change recorded in the last 24 months; 16 vulnerabilities on CISA's KEV list (supported versions receive security fixes).	163 in last 24 months	3,563home pages, 0.04% of crawl, Aug 2026Adobe ColdFusion, all versions	7 Oct 2026
COBOL compilersLanguage and runtime	Supported	New versions continue	Low Low: supported, with new release lines continuing; no exploited-vulnerability or licence signal.	00 in last 24 months	No usage data	7 Oct 2026
DelphiApplication platform	Supported	New versions continue	Low Low: supported, with new release lines continuing; no exploited-vulnerability or licence signal.	00 in last 24 months	No usage data	7 Oct 2026
Heroku stackInfrastructure	Supported	Newest version supported until Apr 2031	Low Low: supported, with new release lines continuing; no exploited-vulnerability or licence signal.	00 in last 24 months	1,506home pages, 0.017% of crawl, Aug 2026Heroku, all versions	7 Oct 2026
IBM i (AS/400)Infrastructure	Supported	New versions continue	Low Low: supported, with new release lines continuing; no exploited-vulnerability or licence signal.	00 in last 24 months	No usage data	7 Oct 2026
IBM z/OSInfrastructure	Supported	New versions continue	Low Low: supported, with new release lines continuing; no exploited-vulnerability or licence signal.	00 in last 24 months	No usage data	7 Oct 2026
jQueryFramework or library	Supported	New versions continue	Low Low: supported, with new release lines continuing; no licence change recorded in the last 24 months; 1 vulnerability on CISA's KEV list (supported versions receive security fixes).	11 in last 24 months	1,631,648home pages, 18.3% of crawl, Aug 2026In-scope versions only	7 Oct 2026
Microsoft SQL ServerDatabase	Supported	Newest version supported until 6 Jan 2036	Low Low: supported, with new release lines continuing; no licence change recorded in the last 24 months; 2 vulnerabilities on CISA's KEV list (supported versions receive security fixes).	21 in last 24 months	No usage data	7 Oct 2026
MongoDBDatabase	Supported	Newest version supported until 31 Oct 2031	Low Low: supported, with new release lines continuing; no licence change recorded in the last 24 months; 1 vulnerability on CISA's KEV list (supported versions receive security fixes).	11 in last 24 months	No usage data	7 Oct 2026
Oracle DatabaseDatabase	Supported	Newest version supported until Dec 2031	Low Low: supported, with new release lines continuing; no exploited-vulnerability or licence signal.	00 in last 24 months	No usage data	7 Oct 2026
Oracle FormsApplication platform	Supported	Newest version supported until Dec 2030	Low Low: supported, with new release lines continuing; no exploited-vulnerability or licence signal.	00 in last 24 months	No usage data	7 Oct 2026
PHPLanguage and runtime	Supported	Newest version supported until 31 Dec 2029	Low Low: supported, with new release lines continuing; no licence change recorded in the last 24 months; 3 vulnerabilities on CISA's KEV list (supported versions receive security fixes).	30 in last 24 months	473,902home pages, 5.3% of crawl, Aug 2026In-scope versions only	7 Oct 2026
PowerBuilderApplication platform	Supported	New versions continue	Low Low: supported, with new release lines continuing; no exploited-vulnerability or licence signal.	00 in last 24 months	No usage data	7 Oct 2026
Ruby on RailsFramework or library	Supported	Newest version supported until 10 Oct 2027	Low Low: supported, with new release lines continuing; no licence change recorded in the last 24 months; 3 vulnerabilities on CISA's KEV list (supported versions receive security fixes).	31 in last 24 months	109,318home pages, 1.2% of crawl, Aug 2026Ruby on Rails, all versions	7 Oct 2026
VMware vSphere (ESXi and vCenter)Infrastructure	Supported	Newest version supported until 12 Aug 2028	Low Low: supported, with new release lines continuing; no licence change recorded in the last 24 months; 18 vulnerabilities on CISA's KEV list (supported versions receive security fixes).	187 in last 24 months	No usage data	7 Oct 2026
TeradataDatabase	Not verified	Dates not verified	Not rated Tracked, not rated: support status unknown.	00 in last 24 months	No usage data	7 Oct 2026

How risk is rated

Each rating follows a published rule and uses only the facts in this table. There are no weights and no scores.

High: Support has ended, or paid extended support ends within 12 months, and the product has at least one vulnerability on CISA’s Known Exploited Vulnerabilities list or no releases since support ended.
Elevated: Only paid extended support remains, or standard support ends within 24 months, or support has ended but CISA lists no exploited vulnerabilities.
Watch: Supported for at least another 24 months, but with a dated warning sign: a licence change or end-of-sale announcement recorded in the last 24 months, or falling job postings. A licence change counts in either direction, whether it opens or closes the licence, because both change what owners must review.
Low: Supported for at least another 24 months with no dated warning sign recorded.
Not rated: Support status not verified yet. The technology is tracked but not rated.

For products that keep shipping new versions (Rails, PHP, vSphere and similar), the 24-month test ignores the end date of the newest version. That date is still shown.

Every rating is shown with its reason. Open a rating in the table to read it.

Download the data

One row per technology with every value and its source URL. The files are generated from the same data as this page, so they always match it.

Legacy Technology Tracker (CSV) — one row per technology
Legacy Technology Tracker (JSON) — the same records with field descriptions and dataset metadata

The tracker data is released under CC BY 4.0. You may copy, adapt and redistribute it, including commercially, if you credit Software Modernization Intelligence and link to this page. Source data stays under its own terms; see the methodology.

Field dictionary

Column names are identical in the CSV and JSON files. Empty cells mean the value is not available or does not apply.

`slug`	string	Technology identifier; the last part of the technology page URL.
`name`	string	Technology name and the versions it covers.
`category`	enum	One of language-runtime, application-platform, framework-library, database, infrastructure, enterprise-server or web-platform.
`scope`	string	What the entry covers, in words: versions in scope and exclusions.
`support_status`	enum	supported, extended-only (only paid extended support remains), unsupported or unknown, on the status_as_of date.
`status_as_of`	date	Date the support status, key_date_months_from_as_of and risk_level are stated for, in YYYY-MM-DD. They are recalculated daily from the data collected on checked_on.
`rolling_releases`	enum	true when the vendor keeps shipping new versions, so the newest version’s end date is not an end for the technology.
`key_date_kind`	enum	Which date key_date is: ended, extended-ends, support-ends, latest-line-ends, rolling, no-end or unknown.
`key_date`	date	The date that matters most for the status, in YYYY-MM-DD. Empty when there is none.
`key_date_precision`	enum	day, or month when the vendor publishes only a month (the date is then that month’s last day).
`key_date_months_from_as_of`	integer	Whole months from status_as_of to the day support lapses: positive means until, negative means since.
`mainstream_support_end`	date	Last day of mainstream (active) support, in YYYY-MM-DD.
`support_end`	date	Last day of standard support including security updates, in YYYY-MM-DD. For rolling products, the newest version’s end.
`extended_support_end`	date	Last day of separately purchased extended support (for example Microsoft ESU), in YYYY-MM-DD.
`support_ended_on`	date	Unsupported only: the last day any vendor support applied, in YYYY-MM-DD.
`support_source_url`	url	Source of key_date (the vendor lifecycle page when we verified that date, otherwise endoflife.date); when there is no key date, the main lifecycle source.
`vendor_lifecycle_url`	url	The vendor’s official lifecycle or support-policy page, when verified.
`extended_support_options`	string	Extended-support offers we checked, separated by semicolons, with their end date when published.
`risk_level`	enum	high, elevated, watch or low under the published rules. Empty when not rated.
`risk_reason`	string	The rule outcome in words, including the facts it rests on.
`kev_scope`	enum	product when KEV entries are matched by vendor and product name; cpe when scoped to versions through NVD CPE data.
`kev_all_time`	integer	Number of CVEs on the CISA Known Exploited Vulnerabilities list for the technology, all time. Empty when not tracked.
`kev_last_24_months`	integer	Of those, the number added to the list in the 24 months before status_as_of.
`kev_newest_date_added`	date	Date the newest matching entry was added to the KEV list, in YYYY-MM-DD.
`kev_source_url`	url	Where the KEV entries can be checked.
`http_archive_month`	date	HTTP Archive crawl month of the usage counts, in YYYY-MM-DD (first day of the month).
`http_archive_mobile_home_pages`	integer	Mobile home pages on which HTTP Archive detected the technology that month.
`http_archive_mobile_share_pct`	number	Those pages as a percentage of all mobile home pages crawled that month.
`http_archive_desktop_home_pages`	integer	Desktop home pages on which HTTP Archive detected the technology that month.
`http_archive_desktop_share_pct`	number	Those pages as a percentage of all desktop home pages crawled that month.
`http_archive_scoped_versions`	string	Version labels summed for the version-scoped count, separated by spaces. Empty when the count is not version-scoped.
`http_archive_scoped_mobile_home_pages`	integer	Mobile home pages on the in-scope versions, where the version is detectable.
`http_archive_scoped_mobile_share_pct`	number	Those pages as a percentage of all mobile home pages crawled.
`http_archive_note`	string	What the HTTP Archive count does and does not cover for this entry.
`http_archive_source_url`	url	HTTP Archive technology report page for the technology.
`npm_package`	string	npm package used for the download count.
`npm_weekly_downloads`	integer	Downloads of that package from the npm registry in the window.
`npm_window`	string	The seven-day window of the download count, as YYYY-MM-DD..YYYY-MM-DD.
`npm_source_url`	url	npm page of the package.
`last_release`	string	Newest release or tag of the in-scope line on GitHub.
`last_release_date`	date	Date of that release or tag, in YYYY-MM-DD.
`last_release_source_url`	url	Where the release can be checked.
`skills_status`	enum	Status of job-posting data. pending-credentials means it is not published yet.
`page_url`	url	Page with the full fact sheet for the technology.
`checked_on`	date	Date the data was collected from its sources, in YYYY-MM-DD.

How to cite

Cite the tracker with its version and data-as-of date:

Software Modernization Intelligence. Legacy Technology Tracker, version 1.0, data as of 2026-10-07. https://softwaremodernizationservices.com/legacy-technology-tracker/. Licensed under CC BY 4.0.

To quote a single fact, keep its date with it and link to the technology’s page, for example:

Adobe Flash Player is no longer supported: vendor support ended on 31 Dec 2020 (5 years and 9 months ago). CISA’s Known Exploited Vulnerabilities catalog lists 36 vulnerabilities in Adobe Flash Player. (Software Modernization Intelligence, Legacy Technology Tracker, status as of 16 Oct 2026, data checked 7 Oct 2026)

Please also credit the original source named next to each value (CISA, HTTP Archive, endoflife.date, the vendor).

Methodology

Sources and their licences, date definitions, the rating rules, how vulnerabilities are matched, limitations and corrections are on the tracker methodology page. Our site-wide approach is on the Methodology page.

Methodology version 1.0. Data period 2026-10, checked 7 Oct 2026. Status, key dates and ratings are recalculated daily from that data (status as of 16 Oct 2026).