Adobe Commerce customers on 2.4.6 have extended support for core quality and security fixes through 31 August 2027, followed by a limited security-only period through 31 May 2028. For 2.4.5, the security-only period runs through 31 May 2027. Adobe’s lifecycle policy sets out the scope of each period.
Merchants running Magento Open Source should not assume that Adobe Commerce’s extended-support terms apply to their stores. They should check the security updates available for their exact version and plan a move to a supported release line.
A production upgrade takes planning. The immediate decision is to establish your current support and patch status, address applicable security updates, and set an upgrade timetable.
What “end of support” actually means
A store does not stop operating when a support milestone passes. What changes is the scope of fixes available for its release line.
Adobe Commerce 2.4.5 left standard support on 12 August 2025. Its extended support ended on 11 August 2026, leaving a limited security-only transitional period. Adobe Commerce 2.4.6 left standard support on 11 August 2026 but remains in extended support for now. Neither period should be treated as a substitute for an upgrade: fixes for the core application have a defined scope, and Adobe does not provide fixes for third-party dependencies such as PHP or database software when those dependencies reach end of life. See Adobe’s support dates and terms.
For Magento Open Source, check Adobe’s security bulletins and release information rather than applying Adobe Commerce support dates to your installation. An exceptional fix or an available isolated patch does not, by itself, extend the release line’s regular support.
The PCI compliance question
Merchants handling card payments need to assess their applicable PCI DSS requirements, including the requirement to install applicable security patches within the specified timeframe. An older Commerce version does not automatically determine the outcome of a PCI assessment. The relevant questions include whether its security updates and platform dependencies are current, which controls are in place and what falls within the merchant’s assessed environment. PCI SSC identifies patching under Requirement 6.3.3.
If your release line or a dependency can no longer receive applicable fixes, discuss the position with your security team and qualified security assessor. Monitoring and other controls can help manage risk, but they should form part of a documented assessment rather than an assumption that an unsupported component is covered. Adobe also highlights the separate support status of PHP and other platform dependencies.
Why this upgrade is different
A Magento or Adobe Commerce upgrade still requires testing of custom code, third-party modules, integrations, and the storefront. The scope depends on the individual build.
There are now two more recent release lines to assess. Adobe Commerce 2.4.8 was released in April 2025 and includes PHP 8.4 and MariaDB 11.4 compatibility, GraphQL improvements, and quality fixes. Adobe Commerce 2.4.9 was released in May 2026 and has standard support scheduled through May 2029. The right target depends on the store’s dependencies and the system requirements, so review the 2.4.8 release notes and 2.4.9 release notes before choosing.
Adobe also introduced monthly isolated security patches. They can provide a narrower way to apply certain security fixes, but they have prerequisites and must be applied in the documented sequence. They do not remove the need for release upgrades or testing.
What extended support does and does not cover
For Adobe Commerce 2.4.6, extended support provides core quality and security fixes through 31 August 2027. Its subsequent security-only period provides limited isolated security fixes through 31 May 2028. Adobe Commerce 2.4.5 is already in its security-only period, which ends on 31 May 2027. These are Adobe’s published lifecycle dates.
These arrangements do not guarantee fixes for third-party software or compatibility with future PHP, database, or extension releases. Use the remaining coverage to plan and test a move to a supported version.
What to do now
Merchants on 2.4.5 or 2.4.6 can take four practical steps:
-
Audit your version and patch level: Record the exact release, cumulative security patch, and any isolated patches applied. APSB26-73, published on 14 July 2026, provided July isolated fixes for specified release lines. Check Adobe’s subsequent bulletins and installation instructions for updates applicable to your store.
-
Confirm your support position: Identify whether you run Adobe Commerce or Magento Open Source, and check the relevant lifecycle terms and available fixes. For Adobe Commerce, confirm any contractual and deployment-specific arrangements with Adobe.
-
Assess the upgrade path: Review PHP, database, third-party module, integration and theme compatibility against the proposed target release. If you use Hyvä, check the specific theme and compatibility-module versions; Hyvä documents its upgrade requirements.
-
Set an achievable date: Agree on the assessment, testing and production-release milestones with the people responsible for the store. Prioritise applicable security fixes while the larger upgrade is prepared.
The bigger picture
The 11 August 2026 milestones were part of Adobe’s published lifecycle, but they had different consequences for 2.4.5 and 2.4.6. The practical direction is the same: establish what coverage and fixes apply to your installation, maintain supported dependencies, and complete a tested move to a supported release.
Delaying an upgrade can increase the work needed to maintain older dependencies and address security findings. The level of risk depends on the store’s actual versions, patches, configuration and controls; it should be assessed rather than assumed.
About On Tap
On Tap is a growth-focused eCommerce consultancy specialising in Magento and Adobe Commerce implementations for mid-market and enterprise merchants. From upgrade planning and third-party module compatibility audits to security patch application and ongoing technical maintenance, On Tap helps merchants move to supported releases with minimal disruption.
If you are on 2.4.5 or 2.4.6 and need help scoping your upgrade path, get in touch.
