Still Running Ektron or Episerver? What Your Association Needs to Know in 2026

Ektron CMS version 9.3 and below officially reached End of Service Life in July 2024. That was two years ago. If your association website is still running on Ektron, or on an older version of Episerver that preceded the Optimizely rebrand, you are now two years into operating on a platform with no security patches, no feature updates, no vendor support, and no future. The runway is not short. The runway ended.

This is not a small number of organizations. Ektron had a meaningful presence in the association and nonprofit CMS market through the 2000s and early 2010s, and platform migrations are expensive, disruptive, and easy to defer. Many associations that knew Ektron was approaching end of life in 2023 and 2024 chose to delay migration because the budget was not available, the timing was not right, or the site still technically worked. Two years later, those organizations are sitting on a compounding risk that gets harder and more expensive to resolve with every passing quarter.

Here is where things stand in 2026, what the real risks are, and what your options look like now.

The Timeline: How Ektron and Episerver Got Here

Ektron was a .NET-based content management system that competed with Sitecore, Kentico, and early versions of Episerver for organizations that wanted an enterprise CMS built on the Microsoft stack. Many associations adopted Ektron during a period when the platform was actively developed and when open-source alternatives like WordPress and Drupal were less mature for enterprise use cases.

In 2015, private equity firm Accel-KKR acquired Ektron and merged it with Episerver, another .NET CMS it owned. The merged company operated under the Episerver name, and Accel-KKR made clear that no future versions of the CMS would carry the Ektron product line forward. Ektron was frozen. Existing installations could continue to run, and limited support continued for a period, but the product was done.

In 2021, Episerver rebranded to Optimizely, pivoting toward digital experience and experimentation tools. The current Optimizely product lineup, CMS 12 and CMS 13, is architecturally different from what Ektron and older Episerver customers originally purchased. Migrating from Ektron to modern Optimizely is not an upgrade path. It is a full replatforming project, comparable in scope and cost to migrating to WordPress or Drupal.

The key dates that matter:

• Episerver CMS prior to version 7: End of Service Life in December 2020. Extended security updates expired December 2023.
• Ektron CMS version 9.3 and below: End of Service Life in July 2024. No patches, no fixes, no support of any kind.
• Episerver CMS 10 and 11: Nearing end of active support. Optimizely maintains CMS 12 and CMS 13 as the only fully supported versions. All new development is focused exclusively on the latest major version.

If you are running anything older than Optimizely CMS 12, you are on borrowed time. If you are running Ektron, that time expired two years ago.

The Security Situation in 2026 Is Worse Than You Think

Running unsupported software is always a risk, but Ektron presents a particularly acute case because of the severity of its known vulnerabilities and the length of time they have been publicly documented without patches.

Unauthenticated remote code execution. Ektron processed user-controlled XSL from pages requiring no authentication, using the .NET XslCompiledTransform class with script execution enabled. An attacker can execute arbitrary code on your web server without ever logging in. This vulnerability has been in public exploit databases for years.

Authentication bypass. Ektron CMS 9.20 SP2 and older versions allow remote attackers to access administrative pages by spoofing the HTTP Referer header. Your CMS admin panel can be accessed without valid credentials.

Unauthenticated file upload. The Upload.aspx endpoint lacks proper authentication controls, allowing malicious ASPX files to be uploaded to your server. Combined with the code execution vulnerability, this is a complete attack chain: upload malicious code, then run it.

XML External Entity injection. The XML parser in Ektron is vulnerable to XXE attacks through the xmlrpc.aspx endpoint, enabling server-side request forgery and local file system access. An attacker can read configuration files, database connection strings, and sensitive data from your server.

These vulnerabilities are not obscure. They are cataloged in the National Vulnerability Database, documented with proof-of-concept exploits, and indexed by automated scanning tools that attackers use to find vulnerable installations. In 2024, when Ektron first went end of life, these were known risks. In 2026, after two additional years of exposure with zero patches, they are effectively open doors.

If your association handles member data, payment information, personally identifiable information, or anything subject to privacy regulations through your website, running Ektron is no longer just a technology problem. It is a liability, compliance, and governance problem.

Why Associations Have Not Moved Yet

If the risks are this clear, why are organizations still on Ektron and old Episerver? The reasons are practical, and understanding them is the first step toward building a realistic migration plan.

Budget constraints. A platform migration for a mid-size association website typically costs $25,000 to $80,000 depending on complexity, platform choice, and scope. That is a significant unplanned expenditure, especially for organizations that have been maintaining flat or declining technology budgets.

Integration complexity. Many Ektron installations are connected to association management systems, single sign-on providers, event platforms, and other internal tools. Migrating the website means rebuilding those integrations on a new platform, which adds cost, complexity, and risk to an already large project.

The site still works. From the outside, the website loads. Content publishes. Members can log in. The urgency of migration does not feel real when the visible symptoms of being on an unsupported platform are not yet apparent. The problem is that security vulnerabilities and technical debt are invisible until they are not, at which point the damage is already done.

Organizational inertia. Migrations require cross-departmental coordination, leadership buy-in, vendor selection, and sustained attention over months. For associations with small staff and competing priorities, a website migration is easy to push to next quarter, and then the quarter after that.

All of these are understandable. None of them change the fact that the risk is compounding.

Your Migration Options in 2026

Whether you are on Ektron or an older Episerver version, you have three realistic paths forward. The right choice depends on your budget, your team, and the complexity of your current implementation.

Option 1: Migrate to WordPress

WordPress powers over 40 percent of all websites globally and has the largest ecosystem of developers, agencies, themes, and plugins of any CMS. For associations, WordPress offers the lowest total cost of ownership of any enterprise-capable platform.

• Licensing: Free. WordPress is open source.
• Implementation: $25,000 to $75,000 for a mid-size association website, depending on design complexity, integrations, and content volume.
• Managed hosting: $600 to $2,400 per year on platforms like Pantheon, WP Engine, or Kinsta.
• Ongoing maintenance: $12,000 to $36,000 per year for updates, security monitoring, and incremental development.
• Five-year total cost of ownership: $90,000 to $250,000.

WordPress is the strongest choice for associations that need an intuitive content editing experience, a large pool of available developers at every price point, and flexibility in hosting and vendor choices. The Gutenberg block editor and modern theme frameworks provide development capabilities that rival enterprise platforms. The plugin ecosystem includes solutions for member directories, event management, learning management, and integration with major association management systems.

The trade-off is that WordPress requires intentional architecture for enterprise-grade personalization and complex content workflows. These capabilities are achievable through plugins and custom development, but they are not built in natively.

Option 2: Migrate to Drupal

Drupal is the open-source platform most directly comparable to enterprise .NET CMS products in terms of content modeling flexibility, user permissions, and multi-site architecture. For associations that had complex Ektron implementations with custom content types, multilingual content, and sophisticated user roles, Drupal often provides the most natural migration path.

• Licensing: Free. Drupal is open source.
• Implementation: $30,000 to $80,000 for a mid-size association website.
• Managed hosting: $600 to $2,400 per year on platforms like Acquia or Pantheon.
• Ongoing maintenance: $12,000 to $36,000 per year.
• Five-year total cost of ownership: $100,000 to $260,000.

Drupal has a steeper learning curve for content editors than WordPress, and its developer talent pool, while large, is smaller than the WordPress ecosystem. However, several agencies specialize specifically in Drupal for associations, which means finding a development partner who understands both the platform and the association context is straightforward. Acquia, the commercial company behind Drupal, offers enterprise hosting, personalization, and marketing automation tools that can replicate Episerver-level capabilities.

Option 3: Upgrade to Modern Optimizely

If your organization is committed to the .NET ecosystem and has budget for enterprise licensing, upgrading to Optimizely CMS 12 or 13 keeps you on a supported platform within the same vendor lineage.

• Licensing: $50,000 to $200,000 or more per year for XM Cloud, depending on deployment complexity.
• Implementation: $100,000 to $250,000. The architectural changes from Ektron and old Episerver to modern Optimizely are significant enough that this is a rebuild, not an upgrade.
• Ongoing maintenance: $50,000 to $150,000 per year.
• Five-year total cost of ownership: $500,000 to $1,000,000 or more.

Optimizely offers strong built-in personalization, A/B testing, and content experimentation tools that are genuinely best-in-class. For associations with dedicated digital teams and six-figure annual digital budgets, it is a legitimate option. For mid-size associations with communications teams of two to five people and total website budgets under $100,000 per year, WordPress or Drupal will deliver comparable outcomes at 20 to 30 percent of the cost.

What a Migration Actually Involves

Regardless of which platform you choose, migrating from Ektron or old Episerver is a significant project. Understanding the scope upfront prevents surprises.

• Content migration. All pages, documents, images, and media assets need to be extracted from your current CMS and mapped to the new platform. Ektron stored content in a SQL Server database with a proprietary schema. Budget for content cleanup during migration. Most organizations discover that 20 to 40 percent of their content is outdated, duplicated, or no longer relevant.
• URL mapping and redirects. Every page on your current site has a URL that may be indexed by search engines, bookmarked by members, or linked from external sources. A comprehensive redirect map ensures that every old URL points to its new equivalent. Failing to handle redirects properly can devastate your search engine rankings.
• Integration reconnection. If your site integrates with your association management system, event platform, learning management system, or single sign-on provider, those integrations need to be rebuilt for the new platform. This is often the most underestimated part of a migration.
• Template and design rebuild. Your site design and page templates need to be recreated on the new platform. Most associations treat a platform migration as a redesign opportunity rather than a one-to-one replica. If your Ektron site has not been redesigned in several years, this is the time to modernize.
• Testing and launch. Budget four to eight weeks after development for quality assurance, content review, stakeholder feedback, and launch preparation. Verify redirects, integrations, content display, and performance under load.

The Cost of Waiting Another Year

Every quarter your association stays on Ektron or unsupported Episerver, the situation gets worse in four specific ways.

Security exposure compounds. A data breach involving member personal information can cost an association hundreds of thousands of dollars in notification costs, legal fees, regulatory penalties, and reputational damage. The known, unpatched vulnerabilities in Ektron are not theoretical. They are documented attack vectors with public exploit code. Automated scanners are looking for exactly these installations.

Compliance risk grows. If your association handles data subject to GDPR, state-level US privacy laws, or PIPEDA in Canada, running a platform with known unpatched critical vulnerabilities may constitute a failure to implement reasonable security measures. Two years past end of life, that argument is very difficult to defend.

The talent pool is nearly gone. Finding developers who can work on Ektron in 2026 is not difficult. It is nearly impossible. The agencies that specialized in Ektron retooled years ago. The developers who knew the platform have moved to other technologies. If you need emergency work on your Ektron site today, you will pay a premium to a shrinking pool of specialists, assuming you can find one at all.

Migration costs increase. The longer you wait, the more content accumulates, the more integrations drift, and the more institutional knowledge about your current implementation fades. An association that migrated in 2024 when Ektron first went end of life likely still had staff who remembered how the site was built. By 2026 or 2027, that knowledge may have walked out the door with employee turnover, making the migration more expensive and more risky.

How to Start

If your association is still running Ektron or an unsupported version of Episerver, the first step is not choosing a new platform. The first step is understanding what you have.

• Inventory your current site. How many pages? How many unique templates? What integrations are active? What content is current and what can be retired? This inventory determines the scope and cost of migration.
• Assess your team and budget. Who will manage the new site day to day? What is the realistic budget for migration and for ongoing annual maintenance? These constraints narrow your platform options quickly.
• Talk to two or three agencies that specialize in association websites. Get migration estimates based on your actual inventory, not generic proposals. Ask for references from associations of similar size that have completed the same type of migration.
• Set a deadline and hold to it. Migration projects without deadlines drift indefinitely. Pick a launch date, work backward to establish milestones, and hold your team and your agency partner accountable to the timeline.
• Stop deferring. The risks are real, the costs are quantifiable, and the alternatives are mature. There is no scenario in which staying on Ektron or unsupported Episerver gets easier or cheaper. It only gets harder.

The Bottom Line

Ektron is a dead platform. It has been dead for two years. Older versions of Episerver are following the same path. The organizations that built websites on these platforms made reasonable decisions at the time, but the technology landscape has moved on decisively. WordPress and Drupal now offer capabilities that match or exceed what Ektron and Episerver provided, at significantly lower total cost of ownership and with vastly larger support ecosystems.

The question for your association is not whether to migrate. That question was answered in July 2024 when Ektron support ended. The question is how much longer you are willing to accept the risk of running a website with known critical vulnerabilities, no security patches, and a developer pool that is nearly extinct. In 2026, the answer should be: not one more quarter.