RSA SecurID primary support ends in stages from December. Here's how you get to 8.9

RSA's support clock runs out on several SecurID parts between now and March: some Windows agents and authenticators in December, Authentication ManagerdefinitionThe server you run yourself, on RSA hardware or as a virtual appliance. When someone types a SecurID code at the VPN, this is what checks it. 8.7 SP2 in January, and more authenticators in March. Find out this week which versions you run, because going from 8.7 SP2 to 8.9 takes two upgrades you can't undo, and an old appliance may not make the trip.

The January date is the one with teeth. RSA's life cycle page says quarterly patches and updates only come out for the latest major release of Authentication Manager, and anything older may get a hotfix if RSA decides it's needed. So a version that's still inside its dates can already be off the main patch train.

Two recent advisories show what that means. RSA rates RSA-2026-15 critical and lists 8.7 SP2 Patch 7 or earlier as affected. It names fixed patches for 8.8 and 8.9, gives none for 8.7 SP2, and tells customers to move to the latest version. RSA-2026-17, also critical, is fixed in 8.9 Patch 5 and its Web Tier patch. Neither advisory says these specific flaws are being exploited, but both repeat Oracle's warning that attackers have succeeded against customers who didn't apply its patches. Your auditor will still ask why a critical advisory on your MFA server has no patch applied.

RSA gives months with no day, but its life cycle page says each date lands at the end of the stated month. Your real budget for December is the holiday change freeze, which arrives sooner than the date does.

One thing the notice doesn't tell you about Selection. RSA ties the change to NIST SP 800-63B-4, and NIST's text does rule out comparing codes and tapping approve. But the same passage says a list of codes to compare doesn't meet its requirement either, since someone can guess from a short list. What NIST asks for is transferring the code, such as typing it into the phone app. RSA's documentation also describes an Input method where the user enters the code.

So if your compliance team measures against 800-63B-4, don't take the automatic move as the end of the conversation. Ask them whether Selection satisfies them, and test Input with a pilot group. Typing a code is more work than tapping one, so the help desk will want warning either way.

Most teams on 8.7 SP2 end up choosing between four routes. Pricing depends on your RSA contract and licence count and RSA doesn't publish it, so we won't guess. Effort turns mostly on how many agents and RADIUSdefinitionAn old protocol plenty of VPNs and network boxes still use. They ask a server if a login's good, and they act on the answer. clients you've got, because the appliance work is the small part.

A word on extended support. RSA's definitions of Level 1 and Level 2 sit in an FAQ behind a customer login, so we can only say what's public: the dates, and that 8.8 and 8.9 have no Level 2. Ask your RSA account team in writing what your level includes, and whether it covers security fixes for the advisories above.

If you're building new, a few details from RSA's migration article will save you a repeat attempt. An 8.9 primary needs Patch 1 or later before it can import users and tokens. Profile names are case sensitive, and device type, authentication type and delivery method have to match exactly. System settings get recreated by hand, identity sources included, and UDP agents need their old node secret cleared before they'll talk to the new server.

We plan and run SecurID upgrades, starting with the inventory that usually decides the whole job. See our RSA SecurID page for what we cover, hire an engineer if your team's short for the cutover, or start with an assessment to find out what's actually talking to your server.