Free trial
EN

Vulnerabilities and patches · Magento 2

Adobe security patches (APSB): check they are really applied to your Magento store

Adobe regularly publishes APSB security bulletins for Magento. Your developer tells you “it's applied”. But the version number does not prove it: every month, Adobe also releases Magento security patches as files that leave that number unchanged. Here is how to read a bulletin, find your version, know whether Adobe still supports it, and check that an Adobe security patch is really in place on your store.

Cédric Michel, Magento developer Adobe certified Published on 10 min read
Illustration: the blue Tocsin24 bell rings above a box marked with a cross-shaped plaster, next to a checklist with three ticked lines.

In short

  • An APSB bulletin announces the vulnerabilities fixed, the affected versions and how to fix them. Its priority tells you how urgent it is: from “as soon as possible” to “within 30 days” or “at your discretion”.
  • Adobe ships its fixes in two ways: -pN releases installed with Composer, and every month isolated patch files, to be applied in order.
  • An isolated patch does not change the version number. To find out whether it is in place, Adobe provides a tool: vendor/bin/patch-status.
  • A version that is no longer supported no longer receives patches. Magento Open Source 2.4.6 already gets none.
Contents

What an APSB security bulletin for Magento is

APSB stands for Adobe Security Bulletin. Each bulletin has a number, such as APSB26-153: the year, then a sequence number. It tells you:

  • which products and versions are affected: Adobe Commerce, Adobe Commerce B2B, Magento Open Source;
  • the solution: the fixed version, or the patch to apply, with a link to Adobe’s article explaining it;
  • the vulnerabilities fixed (CVEs), with their severity, their CVSS score out of 10 and whether an attacker needs to be logged in to exploit them;
  • the priority, from 1 to 3.

The priority is what a store owner needs to remember. Adobe defines it as follows:

Priority What Adobe says
1 Act as soon as possible. The vulnerabilities are being exploited or are at high risk of exploitation.
2 Act within 30 days. High risk of exploitation, no known attacks so far.
3 At the administrator’s discretion. Exploitation is unlikely.

Two recent examples. On 7 September 2026, bulletin APSB26-146, priority 1, fixed a vulnerability rated 10 out of 10, exploitable without an account and already used by attackers. On 13 October 2026, bulletin APSB26-153, priority 2, fixed eleven vulnerabilities, including one rated 10 out of 10 that let anyone run code without logging in.

Adobe’s bulletins have moved to the Adobe Trust Center. Older ones remain archived on Adobe’s former help pages. The simplest option is to subscribe to Adobe’s security notification service.

The three forms of a Magento security patch

  • The -pN security release, for example 2.4.8-p5. It is installed with Composer. It is cumulative: it contains every security fix published before it. Adobe releases at least one a year for each supported version.
  • The isolated patch file, released every month on the second Tuesday. It is a ZIP archive containing one or more .patch files, one per component (CE for Open Source, EE for Adobe Commerce, B2B…). These files are not cumulative: you have to apply every missing one, in month order. And they only apply on top of the latest -pN release of your version line.
  • The hotfix, for a critical vulnerability that is already being exploited, such as APSB26-146.

In recent bulletins, Adobe names fixed versions like this: 2.4.8-2026-oct. It means “2.4.8 with the October 2026 patch”, not a new version number.

Find your Magento store’s version

In the admin panel, at the bottom of every page: “Magento ver. 2.4.8-p5”, for example. That is the version installed by Composer.

This number does not tell the whole story. An isolated patch file changes a few code files without going through Composer: the number is the same before and after. Adobe says so itself: to know where a store stands, you should not rely on the version number alone.

Two stores on 2.4.8-p5 can therefore be in very different states:

  • one has applied the September and October 2026 patches;
  • the other has applied none, or applied one and then lost it.

That is because a patch applied in the vendor/ folder can quietly disappear. If an update or a deployment reinstalls the package concerned, Composer puts back the original file, without the patch.

End of support: is your Magento version still getting patches?

Adobe supports each version for three years from its release. During that time, it receives quality and security fixes. Here is the schedule published by Adobe for Adobe Commerce:

Version Released End of regular support End of extended support End of the “security only” period
2.4.9 12 May 2026 31 May 2029 to be announced —
2.4.8 8 April 2025 31 May 2028 to be announced —
2.4.7 9 April 2024 31 May 2027 31 May 2028 —
2.4.6 14 March 2023 11 August 2026 31 August 2027 31 May 2028
2.4.5 9 August 2022 12 August 2025 11 August 2026 31 May 2027
2.4.4 12 April 2022 12 April 2025 14 April 2026 31 May 2027

Adobe also points out that it does not patch the software Magento relies on: PHP, MySQL or MariaDB, OpenSearch, Redis… Keeping them up to date is your responsibility. For example, PHP 8.2 receives no more security fixes after 31 December 2026. See also our article on the critical PHP vulnerabilities.

You run the store: how to find out and what to ask for

You do not need to open a terminal to get a clear picture.

  1. Write down your version, shown at the bottom of any admin page.
  2. Check in the table above whether it is still supported. If you are on Magento Open Source 2.4.6 or earlier, the question is no longer “which patch” but “when do we upgrade”.
  3. Open the latest bulletin for Adobe Commerce on the Adobe Trust Center. Write down its number, date and priority.
  4. Ask for proof, not a promise. Adobe provides a tool that lists the monthly patches applied, the missing ones, and the status of each vulnerability. Ask your developer for its report.
Message to your agency or developer

Hello,

Adobe published security bulletin [number, for example APSB26-153] on [date]. Our store runs Magento [version shown at the bottom of the admin panel].

Could you confirm:

  1. that our version is still supported by Adobe, and until when;
  2. that the security patches from this bulletin and the previous months are applied in production;
  3. and send us the report from Adobe’s tool (the “php vendor/bin/patch-status” command, run from the store’s folder)?

If a patch is missing, could you tell us when it will be applied? For a priority 1, we would like it done as soon as possible.

Thank you.

You manage the server: check that an Adobe security patch is applied

All commands are run from the Magento folder, as the user who owns the files. None of them changes the store.

  1. The installed version. The first command shows the application version. The second reads it from composer.lock (replace community with enterprise for Adobe Commerce):

    Terminal, from the Magento folder
    bin/magento --version composer show --locked magento/product-community-edition

  2. The status of the monthly patches, with Adobe’s tool. The Commerce Version Tool ships with the monthly patches: it is installed in vendor/bin/patch-status when you apply the July 2026 patch. It reads composer.lock, then tests each expected patch without changing anything. It needs PHP 8.1 or later and the system’s patch command.

    Terminal
    Is the tool installed? php vendor/bin/patch-status --version Full report (JSON) php vendor/bin/patch-status The same report, one line per vulnerability php vendor/bin/patch-status --format=csv

    The report gives the base version, the patches applied (applied_patches), the missing ones (missing_patches), those the tool cannot classify (unknown_patches) and the status of each vulnerability: PROTECTED, VULNERABLE, UNKNOWN or NOT_APPLICABLE. Adobe recommends looking at the missing and unknown patches before drawing a conclusion. If the command cannot be found, the July 2026 patch is not applied.

  3. A specific patch, without the tool. If you have the .patch file downloaded from Adobe’s article, the patch command can check whether it is already in place, without writing anything, by simulating its removal:

    Terminal, from the Magento folder
    patch -p1 --dry-run -R -f < 247p10-2026-10-001-CE.patch

    If the command finishes without an error, the patch is applied. If it shows Hunk #1 FAILED, it is not, or not completely. Replace the name with that of your file.

  4. Apply the missing patches. Follow Adobe’s procedure:

    • test first on a copy of the store, and keep a recent backup;
    • check that you are on the latest -pN release of your version line: isolated patches are only tested against it;
    • apply every missing file, in month order, and for each month CE first, then EE and B2B if they are installed;
    • for each file, from the Magento folder: patch -p1 < file_name.patch (if this fails, Adobe suggests trying -p2);
    • flush the cache, then run php vendor/bin/patch-status again to check.

  5. Keep the patch files in the project, versioned with the code, and reapply them in your deployment process. Otherwise, the next reinstall of vendor/ wipes them out without warning.

What Adobe patches do not cover

Tocsin24 tells you which Adobe patches are missing, on the day

Tocsin24 follows Adobe’s bulletins and its monthly patch archives. As soon as Adobe publishes the month’s archive for your version, without waiting for the details of the vulnerabilities, Tocsin24 warns you if your store does not have the patch (public archives, from 2.4.7 onwards). The Vulnerabilities page shows, for the last six months, each bulletin, the file expected for your version, its status (to apply or applied) and the number of vulnerabilities it fixes. A vulnerability your store remains exposed to opens an incident with the vulnerability’s severity; an actively exploited vulnerability is flagged as such.

The Tocsin24 module records the patches declared on the server: patch files kept in the project (m2-hotfixes, patches or m2-patches folders) and patches declared to Composer. A patch applied by hand whose .patch file is kept neither in these folders nor in Composer is not seen: the page shows it as “to apply”. Hence the advice to keep patch files in the project. When code integrity is monitored, Tocsin24 then checks in the files that each declared patch is still in place: a patch wiped out by a deployment opens a critical incident. The page also shows the support status of your Magento and PHP versions. Tocsin24 does not apply the patches itself.

Try it for free See Magento 2 monitoring

Failles

Inventaire relevé chaque jour par le collecteur « Inventaire des correctifs », et exposition aux failles connues.

Magento

2.4.8-p5

Community

Supportée par Adobe jusqu'au 31 mai 2028

PHP

8.3.27

Correctifs de sécurité seulement, jusqu'au 31 décembre 2027

Module Tocsin24

1.0.2

Dernière vérification

23 octobre 2026 à 09:00

Correctifs de sécurité Adobe

Bulletins Adobe des 6 derniers mois qui visent la version 2.4.8-p5, avec l'archive à télécharger et le fichier de patch qu'elle contient. « Appliqué » quand le module a relevé le patch sur la boutique.

1 patch à appliquer
Octobre 2026
APSB26-153 · bulletin mensuel du 13 octobre 2026 Télécharger 2-4-8-p5-oct-2026.zip, puis appliquer 248p5-2026-10-001-CE.patch 11 failles exposées, dont 1 critique. À appliquer après les patchs des mois précédents (cumulatifs).
À appliquer
Septembre 2026
APSB26-138 · bulletin mensuel du 8 septembre 2026 Archive 2-4-8-p5-sep-2026.zip · patch 248p5-2026-09-001-CE.patch 4 failles corrigées
Appliqué
Septembre 2026
APSB26-146 · hors calendrier du 7 septembre 2026 Exploitée activement Correctif VULN-39341, publié par une annonce Adobe à part 1 faille corrigée
Appliqué

Application screens with example values.

Frequently asked questions

What is an APSB bulletin for Magento?

It is an Adobe security bulletin. It lists the vulnerabilities fixed in Adobe Commerce and Magento Open Source, the affected versions, how to fix them and a priority from 1 to 3. Bulletins are published on the Adobe Trust Center.

How do I know whether a Magento security patch is applied?

The version number is not enough. From the Magento folder, Adobe's php vendor/bin/patch-status command lists the monthly patches applied and missing, and the status of each vulnerability. For a specific file, patch -p1 --dry-run -R -f < file.patch finishes without an error if the patch is in place.

Should I apply every isolated patch, or just the latest one?

Every missing one, in month order. Isolated patch files are not cumulative: each one assumes the previous ones are in place. The next -pN release of your version line bundles them all and resets the count.

How quickly should I apply an Adobe security patch?

The bulletin's priority tells you. Priority 1: as soon as possible, the vulnerabilities are being exploited or highly exposed. Priority 2: within 30 days. Priority 3: at your discretion.

My Magento version is no longer supported. What should I do?

Plan an upgrade. A version out of support no longer receives patches, even for a critical vulnerability. On Magento Open Source, only versions 2.4.7 and later still receive the monthly patches.

Portrait of Cédric Michel

Cédric Michel

Cédric has been building Magento stores for 18 years and holds the Adobe Commerce Developer Expert certification. He created Tocsin24 to monitor the security and health of Magento 2 stores and WordPress sites.

Adobe Commerce Developer Expert badge Adobe Commerce Developer Expert
Verify the certification on Adobe’s website

Sources

  1. Adobe Trust Center: security bulletins and advisories, and priority ratings
  2. Adobe: APSB26-153, security update for Adobe Commerce (13 October 2026)
  3. Adobe: APSB26-146, security update for Adobe Commerce (7 September 2026)
  4. Adobe: archive of Adobe Commerce security bulletins on HelpX
  5. Adobe: knowledge base article on APSB26-153 (ka-49323)
  6. Adobe: monthly isolated security patches policy
  7. Adobe: versioning policy (`-pN` security releases, isolated patches, hotfixes)
  8. Adobe: lifecycle policy and end-of-support dates
  9. Adobe: Commerce Version Tool, overview
  10. Adobe: Commerce Version Tool, generate a report
  11. Adobe: apply an isolated patch file provided by Adobe
  12. Adobe: Quality Patches Tool, usage
  13. PHP: supported versions
  14. Composer: `show` and `audit` commands