Forcepoint Email Security 8.5.4 and 8.5.5 Reach End of Support on 31 December 2026

Short answer: Forcepoint has not discontinued email security. The product is still sold, still supported and still being developed. But if you are running version 8.5.4 or 8.5.5 on premises, support ends on 31 December 2026, and the upgrade is a bigger job than the version numbers suggest.

Here is what the documentation actually says.

The dates

From Forcepoint's Product Support Life Cycle matrix:

Note what is absent: there is no end-of-sale date against any current version. Forcepoint is still selling the product, a new release went generally available in December 2025, and the cloud service published its 2026 release notes in May. This is a version deadline, not a product retirement.

The upgrade is not a patch

This is the part worth knowing before you put a date in the calendar. From the 8.5.7 release notes:

If you are running Forcepoint Email Security version 8.5.5, you can upgrade directly to Forcepoint Email Security version 8.5.7. If you are running any other previous version of Forcepoint Email Security or TRITON AP-EMAIL, you must perform intermediate upgrades.

If you are on 8.5.4, you cannot go straight to 8.5.7. You have to step through 8.5.5 first, and you have roughly fifteen weeks to do both.

Even from 8.5.5, there are prerequisites:

• Upgrading from 8.5.5 requires hotfix 302 installed first
• Upgrading from 8.5.5 in Azure requires hotfix 303 on the source appliance
• Upgrading a virtual appliance requires adding a 26 GB virtual hard disk before you start
• Upgrading from 8.5.5 also requires Appliance version 8.5.5 hotfix 300 (OVA only) and Email Security Gateway 8.5.5 hotfix 3
• Upgrading from 8.5.6 requires Appliance version 8.5.6 hotfix 300 (OVA only) and Appliance 8.5.6 hotfix 1

Underneath it, 8.5.7 is a platform migration rather than a point release. It moves the appliance to Oracle Linux 8, upgrades Postfix from 2.6 to 3.9, moves PostgreSQL to 9.15 from what the notes call "an unsupported version", updates OpenSSL to 3.0.14 and Python to 3.9, and changes service management from daemon-tools to systemd, so the svc and svstat commands in your runbooks will no longer exist.

If you were budgeting an afternoon, budget a project.

Two things that catch regulated customers

Windows Server 2016 support ends with this version. The release notes say it plainly: "This version ends support for: Microsoft Windows Server 2016 (all versions)." The Forcepoint Security Manager and Email Log Server run on a separate Windows machine, so if that box is on Server 2016, your email upgrade is also an operating system upgrade. On the other side, 8.5.7 adds support for SQL Server 2022, VMware ESXi 8.0 and 7.0, and Microsoft AD 2022.

FIPS mode is not supported, and it turns itself off. This one is filed under Known Limitations rather than announced, and it is the most important line in the document if it applies to you:

Forcepoint Email Security version 8.5.7 does not support FIPS mode. If customers have it enabled, FIPS mode is disabled by default after upgrading or migrating to Forcepoint Email Security version 8.5.7.

If you run FIPS mode for a compliance obligation, upgrading silently removes it. Check this before you schedule anything, and check what your obligation actually requires.

What 8.5.7 fixes, and when those problems started

The security update list in 8.5.7 is long, and the dates are worth reading. The release, published in April 2026, includes fixes for:

• A directory traversal vulnerability in the TIBCO JasperReports library, CVE-2018-18809
• Oracle Java vulnerabilities CVE-2020-14803, CVE-2021-23841, CVE-2021-3450, CVE-2021-2161 and CVE-2021-2163, described as "Missing Oracle Java Critical Patch Updates"
• A Spring Framework denial of service issue, CVE-2022-22950, and a Spring Security authorisation bypass, CVE-2022-22978
• A libcurl cookie injection vulnerability, CVE-2023-38546
• Multiple OpenJDK vulnerabilities from 2023
• Apache Tomcat 7.0.109, which the notes describe as "no longer supported, exposing the system to unresolved security vulnerabilities"
• An OpenSSL 1.0.2y vulnerability on application hosts
• Saved database passwords exposed in plain text through the Log Database status check, in versions prior to 8.5.5
• The subscription key displayed in plain text on the Subscription page
• Stored cross-site scripting in Real Time Monitor email log entries, and further cross-site scripting through attachment names in Blocked Messages
• A privilege escalation path via an unquoted service path in the WebsenseEsgStunnel service

Accumulating fixes into a major release is normal practice for on-premises software. The span here is what stands out. Several of these are component vulnerabilities that were public years before this release shipped, and they were present in the product until April 2026. That is a reasonable thing to raise at your next renewal conversation, whatever you decide to do.

One current known issue is also worth noting if you rely on it: "The Resume Processing functionality for quarantined messages under PEM > General Settings is currently non-functional."

If you are on Forcepoint Email Security Cloud

Different product, different position, and no 31 December deadline. The cloud service runs an annual release cycle and published its 2026 release notes on 19 May 2026. The change most likely to affect you is the deprecation of the Verify and Verify+CN TLS options, following removal of the TLS Web Client Authentication extended key usage from publicly trusted certificates. Existing settings transitioned automatically to Encrypt and Encrypt+CN from 18 May 2026. Worth confirming that landed cleanly on your tenant if nobody has looked.

The wider pattern

An upgrade deadline on its own is routine. Every vendor has them, including us. What makes this one worth a conversation rather than a change ticket is the company around it.

Since July 2026 Forcepoint's own description of itself reads: "Forcepoint is the global AI data security leader. The company's AI Data Security platform knows sensitive data as it is created, adapts the moment risk changes and protects continuously across cloud, web, networks, email, endpoints and AI."

Email is the fifth item in that list. That is not a criticism of the product and it does not mean email security is going away. It does mean email is now a component of a data security platform rather than the point of the purchase, and roadmap attention tends to follow positioning.

Two other dates from the same lifecycle matrix, for context:

• Standalone Forcepoint CASB ended sale on 23 December 2022 and support on 23 December 2023, with existing customers migrated to what was then Forcepoint ONE.
• Forcepoint URL Filtering 8.5.5 ended support on 31 December 2025.

The platform has also been renamed twice in two years. Forcepoint ONE became Forcepoint ONE Data Security in 2024, then Forcepoint Data Security Cloud in April 2025, and now sits beneath the AI Data Security platform. The underlying secure service edge technology came from the Bitglass acquisition in October 2021.

None of that is unusual for a vendor of Forcepoint's age and acquisition history. It is simply the context for a renewal decision.

What to do before 31 December

Find your version number. 8.5.4, 8.5.5 or the 8.5.6 appliance means you have a deadline. 8.5.7 means you do not.

If you are on 8.5.4, start now. You need an intermediate upgrade before you can reach 8.5.7, and fifteen weeks is not generous for two upgrades of an appliance-based mail system.

Check the prerequisites before you book the window. The right hotfix, and for virtual appliances the 26 GB disk, need to be in place first.

Check your Windows Server versions. Server 2016 anywhere in the deployment turns this into two projects.

Check your FIPS position. If you need it, 8.5.7 removes it without asking.

Update your runbooks. svc and svstat are gone under systemd.

Do the work in October or November. A 31 December deadline means finished, not started, before the holidays, and December is a poor month for mail flow changes.

And if your renewal lands nearby, it is a fair moment to ask what you are buying: a specialist email security product, or a component of a data security platform that happens to include email.

Where we come in

We are not going to tell you Forcepoint email security is being discontinued, because it is not.

What we would say is this. If you are about to spend a project's worth of effort on an intermediate upgrade, a Linux platform migration and possibly a Windows Server rebuild, that is a reasonable moment to look at what else is available before you commit.

TrustLayer Mail is email security and compliant archiving for UK organisations of roughly 100 to 10,000 people. It deploys through Microsoft 365 connectors or traditional MX routing, and is bought through BT, an MSP or a reseller you may already hold a contract with. It is one of four layers on one platform, alongside web and cloud app control, security awareness training, and Microsoft 365 posture management. There are no appliances to upgrade.

Book a demo. Thirty minutes with an engineer. Bring your current version number.

---

Sources. Version dates from Forcepoint's Product Support Life Cycle matrix, read 15 September 2026. Upgrade paths, system requirements, security updates and known limitations from the Forcepoint Email Security 8.5.7 Release Notes, Revision A, published 7 April 2026. Cloud details from the Forcepoint Email Security Cloud 2026 release notes, published 19 May 2026. Forcepoint may update these at any time; check against the source before acting.