Sitecore XP 10.5 shipped on 5 August 2026: what the release contains and what the upgrade costs

Sitecore released Experience Platform 10.5.0 on 5 August 2026, the date its release-notes publication history records. The release is platform currency and security hardening: newer Windows Server, SQL Server and Solr versions, a move to .NET Framework 4.8.1, and patches for several classes of vulnerability. Taking it also resets an estate’s support position, because KB0641167 puts XP 10.5 in Mainstream Support to 31 December 2029.

For an XP owner reading the support-model change we covered in August, that runway is the point of the release. The release notes are equally specific about what the upgrade costs, and most of that cost falls due before the upgrade itself starts. Where it runs past what another platform cycle is worth, /migrate/sitecore/ is where to put the estate in front of us.

What the release contains

The release-notes page covers platform versions and security, across its highlights and the platform rows beneath them:

• Windows Server 2025 is supported for on-premises (SIF/SIA), containerized (Docker Compose) and orchestrated (AKS) deployments.
• SQL Server 2025 is supported for all Sitecore database roles, with SQL Server 2022 still supported (PDXP-16497).
• Apache Solr 10 is supported, including Solr 10’s mandatory Basic Authentication, and Solr connection strings now accept embedded credentials (PDXP-16492).
• The platform targets .NET Framework 4.8.1, with all platform and component assemblies updated from 4.8 (PDXP-22923).
• Security hardening includes patches for critical vulnerabilities: a pre-authentication XAML cache poisoning attack, a post-authentication remote code execution chain, SPEAK path traversal, and hard-coded credential removal.
• Deprecated JavaScript libraries have been removed as listed in KB1008535 (PDXP-16510, PDXP-16504, PDXP-24274, PDXP-24474).
• Package installation can now be disabled by configuration to reduce the attack surface.

Sitecore names the vulnerability classes and calls them critical, without publishing CVE identifiers or CVSS scores on this page, so that is as far as the source goes.

The support runway it buys

The version dates come from KB0641167, Sitecore’s Product Support Lifecycle article, read again on 3 September 2026. That article gives XP 10.5 an initial release date of August 2026, Mainstream Support to 31 December 2029, Extended Support to 31 December 2032 and Sustaining to 31 December 2034. It counts the phases from a product’s general availability date: Mainstream to three years, Extended to six, Sustaining to eight.

Mainstream matters more than the later two dates. It is the phase the updated support model left untouched, where security updates and production incident assistance stay in the included column instead of carrying the $ marker. The same article records the two conditions the KB puts on upgrade assistance: the work follows Sitecore’s official version upgrade instructions, and the version being upgraded to is in Mainstream Support. XP 10.5 satisfies the second one until the end of 2029.

What the upgrade costs

Alongside the features, the release notes carry prerequisites and removals. These are the ones that reach an existing estate.

The container host OS moves first. Windows Server 2019 container images are no longer shipped. Sitecore 10.5 images are built on Windows Server 2022 (ltsc2022) and Windows Server 2025 (ltsc2025) only, and the notes state that customers running containerized deployments on Windows Server 2019 must migrate their host OS to Windows Server 2022 or 2025 before upgrading (PDXP-16482, PDXP-10623).

Identity Server becomes a separate module. It is no longer included in the SXP platform ARM templates. From 10.5 it deploys as an independent module with its own ARM template, and Azure PaaS deployments have to use that separate template (PDXP-6039).

Application Insights needs new configuration. Connection Strings are now required and Instrumentation Key support has been removed. An estate using AppInsightsKey with an Instrumentation Key value in AppSettings.config has to replace it with a Connection String value (PDXP-12478, PDXP-11667).

Solr 10 is supported, and it authenticates. Sitecore 10.5 adds compatibility with Solr 10.0.0, including support for Solr 10’s mandatory Basic Authentication, and Solr connection strings now accept embedded credentials (PDXP-16492). An estate that takes Solr 10 has to supply credentials on every Solr connection; the release notes add Solr 10 as a supported option rather than requiring the move.

The built-in GraphQL Playground is gone. The notes record that the HotChocolate.AspNetClassic.Playground library was deprecated and contained critical bugs, and point to a third-party tool such as Postman or Insomnia for GraphQL introspection and query execution (PDXP-23055).

A prerequisite version was raised. The minimum required version of the Microsoft Visual C++ Redistributable has been updated, and the notes state that the updated prerequisite must be installed before upgrading (PDXP-18745).

Each of these is work to schedule, test and sign off inside the upgrade window, on top of the version upgrade itself.

What the release does not add

Sitecore describes the authoring change as a refreshed visual design across selected authoring experiences, including an updated color scheme and more consistent styling, with no functional changes to existing workflows.

The new-features categories on the page are Containers, Identity, Performance, Platform, Publishing, Search, Security and xConnect. No new marketing, personalization or AI functionality is listed among them.

Upgrading is a legitimate answer

For an estate that is close to current, has its Solr and Azure configuration in reach, and is not running containers on Windows Server 2019, 10.5 does what an XP owner wants: it applies the security work in this release and buys a support phase that runs to the end of 2029. That is the shortest path and often the correct one.

The calculation changes when the prerequisites are the project. A container estate on Windows Server 2019, an Azure PaaS deployment with Identity Server wired into the platform templates, Application Insights configured on an Instrumentation Key, and a Solr 10 move planned into the same window add up to an infrastructure programme with a CMS upgrade attached. At that point the comparison worth making is this upgrade cycle against the next platform, with both of them priced.

Our Sitecore to Payload migration guide covers the item and template mapping, the export path and the cutover. If you want the comparison costed against your own release line, container platform and Solr setup, bring those details to /migrate/sitecore/: a free consultation and a scoped, fixed quote come before any commitment.

FAQ

1. Does upgrading to Sitecore XP 10.5 extend my support?

   It moves the estate into the Mainstream Support phase. KB0641167 gives XP 10.5 an initial release date of August 2026 and Mainstream Support to 31 December 2029, and Mainstream is the phase where the support matrix is unchanged by the model that took effect on 1 June 2026. Upgrade assistance is also entitled only where the target version is in Mainstream Support.

2. What breaks when upgrading to Sitecore XP 10.5?

   The release notes list several changes that have to be handled before the upgrade starts: Windows Server 2019 container images are no longer shipped (PDXP-16482, PDXP-10623), Identity Server is no longer in the SXP platform ARM templates (PDXP-6039), the built-in GraphQL Playground has been removed (PDXP-23055), Solr 10 is newly supported and brings mandatory Basic Authentication for estates that adopt it (PDXP-16492), Application Insights requires Connection Strings with Instrumentation Key support removed (PDXP-12478, PDXP-11667), and the minimum Microsoft Visual C++ Redistributable has been raised (PDXP-18745).

3. Do I have to move off Windows Server 2019 to run Sitecore XP 10.5?

   For containerized deployments, yes. The release notes state that Sitecore 10.5 container images are built on Windows Server 2022 (ltsc2022) and Windows Server 2025 (ltsc2025) only, and that customers running containerized deployments on Windows Server 2019 must migrate their host OS to Windows Server 2022 or 2025 before upgrading (PDXP-16482, PDXP-10623).

4. What happened to Identity Server in Sitecore XP 10.5?

   It moved out of the platform ARM templates. The release notes state that Identity Server is no longer included in the SXP platform ARM templates and, starting in 10.5, is deployed as an independent module with its own ARM template. Customers deploying to Azure PaaS have to use the separate Identity Server module template (PDXP-6039).

5. Does Sitecore XP 10.5 change the authoring experience?

   The change Sitecore lists is visual. The release notes describe a refreshed visual design across selected authoring experiences, including an updated color scheme and more consistent styling, with no functional changes to existing workflows. The new-features categories on the page are Containers, Identity, Performance, Platform, Publishing, Search, Security and xConnect, and no new marketing, personalization or AI functionality is listed.

Sources

• Sitecore, Experience Platform 10.5 release notes — the 5 August 2026 publication history line, the highlights, and every PDXP reference cited above, read 3 September 2026
• Sitecore, Product Support Lifecycle (KB0641167) - the XP 10.5 phase dates, the three/six/eight-year phase lengths and the upgrade-assistance conditions, read 3 September 2026 (last updated 14 August 2026). The page renders its tables with JavaScript, so a plain fetch returns an empty shell; open it in a browser
• WAYF, Sitecore Extended Support no longer includes security updates (26 August 2026) — the KB0641167 version dates and phase lengths reused here
• WAYF, Sitecore to Payload migration guide — item and template mapping, export path and cutover
• WAYF, Sitecore migration review — where to bring a release line, container platform and Solr setup for scoping