Software support windows, vendor by vendor

How long each vendor says it supports the software it ships, and whether it says so at all. From 11 December 2027 the Cyber Resilience Act asks for a support period, as a rule at least five years, and its end date at the time of purchase.

The 90 installable products of 61 vendors, by what their vendor states; 30 vendors are services with nothing to install. 69 vendors are not yet collected: we have not found or not been able to read a support page for them, which is not the same as their having none.

On a narrow screen this table shows the answer only. Plan, source and date are on each vendor's own page.

What the Cyber Resilience Act asks, and when

From 11 December 2027 (Regulation (EU) 2024/2847, Art. 71), a manufacturer of software placed on the EU market must:

• set a support period during which it handles the product's vulnerabilities, at least five years unless the product is expected to be in use for less (Art. 13(8));
• state the end date of that period, at least month and year, at the time of purchase (Art. 13(19));
• keep each security update available for ten years after it is issued, or for the rest of the support period if that is longer (Art. 13(9)).

Two provisions keep these figures from being compared with the windows above. A manufacturer may fix vulnerabilities only in the version it last placed on the market, provided users of earlier versions can move to it free of charge (Art. 13(10)), so a 12-month window per version can sit inside a five-year support period for the product. And software placed on the market before 11 December 2027 is covered only once it is substantially modified after that date (Art. 69(2)). The obligation to report actively exploited vulnerabilities and severe incidents (Art. 14) has applied to all of it since 11 September 2026.

Correction, 19 October 2026. Until this date the page measured each stated window against the CRA's five-year support period and counted products as falling short of it. Most windows here are per version, which Art. 13(10) allows inside a longer support period, so that comparison was not like for like and has been removed. The windows themselves, as the vendors state them, are unchanged.

Security contacts

Where a vendor publishes /.well-known/security.txt (RFC 9116), that is the machine-readable route for reporting a vulnerability to them. The standard makes a Contact and an Expires field mandatory; a file without them, or one past its date, falls short of the standard.100 of 160 vendors publish one; 32 of those lack a mandatory field or have expired. Counted and listed: how vendors tell you where to report a vulnerability.

Download the data (CSV): every row with its source and the date it was read.Cite as: eucsoft, “Software support windows”, https://eucsoft.com/en/support-windows/, data read up to 2026-10-19.