Magento 2 Security Patches
Last updated: 2nd November 2026. Covers bulletins up to APSB26-153 (13th October 2026).
This page lists the Magento 2 and Adobe Commerce security patches Adobe has shipped in 2025 and 2026: the bulletin, the fixed versions, the isolated patch or hotfix ID, and which ones a store needs. Every row links to Adobe’s bulletin or knowledge base article, and to my write-up where there is one. The write-ups are the narrative; this page is the reference I update each month.
Which Magento security patches do I need?
As of 2nd November 2026, a fully patched store has all of these, in this order:
- The latest
-prelease for its line:2.4.9,2.4.8-p5,2.4.7-p10,2.4.6-p15,2.4.5-p17or2.4.4-p18. These came out with APSB26-49 on 12th May 2026, and every isolated patch since is built against them. - Every monthly isolated patch since July 2026, in release order:
2026-07-001(APSB26-73),2026-08-001(APSB26-92),2026-09-001(APSB26-138),2026-10-001(APSB26-153). They are not cumulative. Adobe’s APSB26-92 article says they “must be applied cumulatively, in release order”, and August will not apply without July. - The StyleSmuggler hotfix, VULN-39341 (APSB26-146, CVE-2026-75650). Adobe’s APSB26-153 article says it “is not included in the October Isolated patch file” and must be applied separately.
- On 2.4.8-p5 only, the October re-issue
248p5-2026-10-002-CE. Adobe re-published the October CE file on 16th October 2026 after the first one shipped without a hardening change (ka-50927). Same file name as the original, so a copy downloaded on the 13th is the old one.
On an older -p release, the isolated patches will not apply. I force-applied the July 2.4.8 patch to 2.4.8-p4 and it failed with hunk conflicts across half a dozen files (details). Upgrade to the latest -p first.
Two edition caveats from Adobe’s own pages:
- Magento Open Source patches are only downloadable for 2.4.6 and later (ka-37421). 2.4.4 and 2.4.5 files are Adobe Commerce only.
- The Solution tables in APSB26-138 and APSB26-153 list Magento Open Source fixes for 2.4.7, 2.4.8 and 2.4.9 only, although 2.4.6 is in the affected list. On Open Source 2.4.6, plan the move to 2.4.7.
Magento security bulletins, 2025 to 2026
Adobe names patched builds by month in the 2026 bulletins: 2.4.8-2026-sep means 2.4.8-p5 with every isolated patch up to September applied.
| Bulletin | What it is | Fixed in | Names and IDs | My write-up |
|---|---|---|---|---|
| APSB26-153 13th October 2026 KB | Monthly isolated patch, priority 2 | 2.4.4-2026-oct to 2.4.9-2026-oct | 2026-10-001; 2.4.8-p5 re-issue 248p5-2026-10-002-CE (ka-50927) | None yet |
| APSB26-138 8th September 2026 KB | Monthly isolated patch, priority 2, 8 CVEs | 2.4.4-2026-sep to 2.4.9-2026-sep | 2026-09-001, CVE-2026-76200, CVE-2026-76201 and six more | September isolated patch |
| APSB26-146 7th September 2026 KB | Emergency hotfix, priority 1, exploited in the wild | Hotfix on any 2.4.4 to 2.4.9 build | StyleSmuggler, CVE-2026-75650, VULN-39341, CVSS 10.0 | Incident response, runbook |
| APSB26-92 11th August 2026 KB | Monthly isolated patch, priority 2, 7 CVEs | 2.4.4-2026-aug to 2.4.9-2026-aug | 2026-08-001, CVE-2026-71362, CVE-2026-48411 to CVE-2026-48416 | APSB26-92 |
| APSB26-73 14th July 2026 KB | First monthly isolated patch, priority 2, 14 CVEs | 2.4.4-2026-jul to 2.4.9-2026-jul | 2026-07-001, adds vendor/bin/patch-status | APSB26-73 |
| APSB26-49 12th May 2026 | Security release, priority 2, 15 CVEs | 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 | CVE-2026-34645 to CVE-2026-34656, CVE-2026-34658, CVE-2026-34685, CVE-2026-34686 | None |
| APSB25-88 September 2025 | Critical hotfix | Hotfix, or the latest -p release | SessionReaper, CVE-2025-54236, VULN-32437; magento/out-of-process-custom-attributes 0.4.0 | Session Reaper, docs |
| APSB25-50 10th June 2025 | Security release with isolated patches | Latest -p release, or the patches | VULN-31609 (CVE-2025-47110, 2.4.4 to 2.4.8), VULN-31547 (2.4.8 only) | None |
| APSB25-08 11th February 2025 | Security release with isolated patch | Latest -p release, or the patch | VULN-28982 (CVE-2025-24434), files vuln-28982-2-4-[4-8]x-v2 | None |
Older bulletins, CosmicSting (APSB24-40, CVE-2024-34102) and Trojan Orders (APSB22-12, CVE-2022-24086) included, are on Adobe’s bulletin index. My write-ups: CosmicSting, Trojan Orders.
How do I check which patches a store has?
Adobe ships the Commerce Version Tool inside the July 2026 CE patch. Once that patch is on, run it from the Magento root:
php vendor/bin/patch-statusIt lists each monthly patch under applied_patches or as missing. An UNKNOWN on 2.4.8-p5 usually means the original October file, see the re-issue above. Adobe says UNKNOWN alone does not mean the store is vulnerable.
On Adobe Commerce Cloud, the Quality Patches Tool reports hotfixes by VULN ID. Adobe’s example (ka-37421) greps for one:
vendor/bin/magento-patches -n status | grep "27015\|Status"If the store uses m2-meta-security-patches, the installer checks each patch against the files on disk rather than trusting a lock record:
composer magento-patches:status -v # per patch and per target
composer magento-patches:verify # non-zero exit if anything is missingThe meta-package strips vendor/bin/patch-status from Adobe’s patches, because it is a new-file hunk that breaks re-applying (why). Use magento-patches:verify there instead.
How do I apply them?
- Magento Open Source or Mage-OS: m2-meta-security-patches carries every isolated patch and emergency hotfix above, pinned to exact versions, applied by the Magento Patch Installer. Each month’s release is tagged to match:
2026.07.14,2026.08.11,2026.09.08,2026.10.13, with2026.10.15carrying the 2.4.8-p5 October re-issue (releases). - Adobe Commerce: the meta-package refuses to install, because CE patches alone leave the EE code unpatched (why). Download the zip from each month’s KB article above and apply CE, then EE, then B2B, previous month first.
- Adobe Commerce Cloud: Adobe warns not to apply an isolated patch the latest
magento/magento-cloud-patchesalready contains. It “can cause installation failures”. - Across many stores: patching Magento at scale covers emergency live patching with Ansible and a central Composer patch package.
Rotate the encryption key and every credential it protected after VULN-39341 if the store was exposed before 7th September 2026. Adobe’s APSB26-146 article lists them, and the StyleSmuggler runbook covers checking for compromise first.