Magento Security Patches Calendar 2026

Adobe has published 19 security bulletins for Adobe Commerce and Magento Open Source since January 2024, including seven in 2026. Since January 2026, Adobe ships fixes monthly as isolated patch files, usually on the second Tuesday, with one cumulative security patch each May. The latest bulletin is APSB26-153 (October 13, 2026). The StyleSmuggler hotfix from APSB26-146 is a separate patch you must apply on top of it.

Most Magento breaches don’t start with a brilliant attacker. They start with a patch that was available and not installed. The pattern has repeated for years, and 2026 added a twist: Adobe changed how it releases fixes, so even diligent teams can lose track of which patch level they’re on.

This guide is the reference we wish existed. It covers the calendar, what each bulletin explains in simple words, how the 2026 schedule is set up, what the three biggest problems from the last two years show us, and a monthly plan you can use without feeling worried.

The Complete Calendar: Every Bulletin, 2024–2026

Dates come from Adobe’s bulletin index (checked October 15, 2026). Where Adobe’s page doesn’t show a priority, the table says “see bulletin.”

Three things stand out:

• Second-Tuesday rhythm. Every scheduled bulletin since 2024 landed on the second Tuesday of its month. The exceptions are the extra bulletins in November 2024 and September 2025, and the emergency hotfix on Monday, September 7, 2026.

• The pace increased. Six bulletins in 2024, six in 2025, and seven in 2026 so far.

• Priorities move. Adobe revised the priority of CosmicSting’s bulletin twice and SessionReaper’s once. A priority 2 bulletin can become priority 1 a few weeks later.

Where to find bulletins now: Adobe has moved its security bulletins to the Adobe Trust Center. Bulletins published through September 22, 2026 remain on HelpX as an archive, and Adobe runs a security notification service for new ones. Bookmark the Trust Center page and subscribe, so you hear about a priority 1 release from Adobe and not secondhand.

How Adobe’s 2026 Patch Schedule Works

This is the biggest change for anyone who patches Magento themselves. From January 2026, Adobe Commerce moved to a monthly release model. Isolated security fixes (individual, non-cumulative, covering all supported lines) may ship every month. A security patch ships at least once a year, in May, and includes all earlier isolated fixes. A full 2.4.x LTS patch also ships in May, and beta patches come in March and November.

Adobe’s versioning policy describes isolated patches as non-cumulative security fixes released independently from a full security patch so they can be implemented faster, each addressing a specific problem and later included in a full security patch. The practical consequence is that you must track which month you’re on. Adobe’s bulletins list the previous month’s label as affected, so a store on 2.4.9-2026-sep is exposed to the October fixes until it applies 2.4.9-2026-oct. 

Monthly fixes also aren’t always installable with a plain Composer update. Adobe’s knowledge base explains that October’s fixes aren’t Composer packages because they’re classified as isolated security fixes, and the patch files require your Composer keys to download. 

Bulletin by Bulletin: 2026

APSB26-153 (October 13, 2026), Priority 2. Adobe describes it as addressing critical, high, and medium flaws that could lead to arbitrary code execution, privilege escalation, arbitrary file system write, and security feature bypass. Affected stores are those at -2026-sep or earlier, and the fix labels are -2026-oct. Adobe’s bulletin repeats that you must also apply the StyleSmuggler hotfix. I see that the Open Source fixes cover versions 2.4.9, 2.4.8, and 2.4.7, and a third‑party analysis shows that Open Source 2.4.6 has no fix and needs an upgrade, while licensed Adobe Commerce 2.4.6 does receive a fix.

APSB26-138 (September 8, 2026). The September isolated patch fixes moderate vulnerabilities in Adobe Commerce and Magento Open Source. The September isolated patch also reminds me about the StyleSmuggler hotfix. Fixes carry the -2026-sep label. Check Adobe’s bulletin for the full CVE list. APSB26-146 (September 7, 2026), Priority 1. This is StyleSmuggler, covered in its own section below.

APSB26-92 (August 11, 2026), Priority 2. The update fixes seven vulnerabilities, five of them critical, including an unauthenticated customer account takeover. It was shipped as isolated patch files and not as new Composer packages. Fixes carry the -2026-aug label. This is a good example of a month where nothing was “exploited in the wild,” yet the flaw was serious, because the account takeover needed no login.

APSB26-73 (July 14, 2026) Priority 2. This update fixes 14 vulnerabilities. Eight are important, and two are moderate. Among them is an unrestricted file upload that didn’t require any login and a webhook flaw that let attackers run code if they were admins. Adobe didn’t know of any attacks using these flaws. This was the release to use month-stamped version labels, like 2.4.8-2026-jul.

APSB26-49 (May 12, 2026) Priority 2. It fixes 15 vulnerabilities. Ten of them are critical. These include issues like running code writing to the file system, denial of service, and bypassing security features. The fixed versions are 2.4.9, 2.4.8-p5, 2.4.7-p10, and 2.4.6-p15. This update came out the day after Magento 2.4.9, which is why 2.4.9 appears as a fixed version.

APSB26-05 (March 10, 2026) Priority 2. This one resolves 19 vulnerabilities. Six critical, twelve important, and one moderate. The problems cover privilege escalation, code execution, denial of service, and file reading. Adobe didn’t see any exploits in the wild for these. The fixed versions start at 2.4.8-2.4.7-p9 and 2.4.6-p14.

Bulletin by Bulletin: 2025

APSB25-94 (October 14, 2025). The 2.4.8‑p3 release notes contain this security patch that includes the fix for CVE-2025-54236. The notes also warn developers to review the REST API constructor parameter validation to make sure extensions follow the security changes. If you maintain custom or third‑party modules, APSB25‑94 matters.

APSB25-88 (September 9, 2025) was initially rated Priority 2, later rated Priority 1. APSB25‑88 is SessionReaper, which is covered below.

APSB25-71 (August 12, 2025) was rated Priority 2. A third‑party summary says APSB25‑71 resolves critical and important flaws, with fixes in 2.4.8‑p2, 2.4.7‑p7, and 2.4.6‑p12. Treat the fixed‑version list as a hint. Confirm it in Adobe’s bulletin.

APSB25-50 (June 10, 2025) Priority 1. Adobe rated APSB25‑50 because it fixes a cross‑site scripting flaw, CVE-2025-47110, with a CVSS score of 9.1 that could allow arbitrary code execution. The fixes are in 2.4.8‑p1, 2.4.7‑p6, 2.4.6‑p11, 2.4.5‑p13 and 2.4.4‑p14. This flaw needs admin privileges. Adobe also issued an isolated patch for APSB25‑50.

APSB25-26 (April 8, 2025). A version tracker lists CVE-2025-27189, an authorization flaw that allows a security feature bypass. APSB25‑26 was published with the 2.4.8 availability release. Older lines received fixes in their April 2025 patch versions.

APSB25-08 (February 11, 2025). Adobe’s page lists a patch for CVE-2025-24434 with a priority rating of 1. Adobe updated the bulletin on April 16, so reread the bulletin before relying on a copy.

Bulletin by Bulletin: 2024

APSB24-90 (November 12, 2024), Priority 3. This unusual bulletin covers Commerce Services Connector (3.2.5 and earlier, fixed in 3.2.6) for features powered by Commerce Services and deployed as SaaS. It resolves a critical code execution flaw, and Adobe was not aware of any exploits. It doesn’t affect stores that don’t use Commerce Services, but it’s easy to miss because it isn’t a core release.

APSB24-73 (October 8, 2024). A scheduled October release. A version tracker lists CVE-2024-45115, an improper authentication flaw allowing privilege escalation without prior authentication, as part of this set.

APSB24-61 (August 13, 2024). I want to share that this scheduled update for Adobe Commerce, Magento Open Source, and the Webhooks Plugin fixes critical, important, and moderate flaws. The flaws could cause code execution, file system read, security feature bypass, and privilege escalation. Adobe’s knowledge base also describes an isolated patch for CVE-2024-39397 for stores running Apache.

APSB24-40 (June 11, 2024). This is CosmicSting, covered below.

APSB24-18 (April 9, 2024) Priority 3. I want to share that this update resolves vulnerabilities that could lead to arbitrary code execution. Fixes are available in 2.4.7, 2.4.6-p5, 2.4.5-p7, and 2.4.4-p8. Adobe

APSB24-03 (February 13, 2024) Priority 3. I want to share that this update resolves important and moderate vulnerabilities. The impacts include code execution, security feature bypass, and application denial of service. Fixes began with 2.4.6-p4, 2.4.5-p6, and 2.4.4-p7.

The Three Flaws That Changed How We Patch

CosmicSting (June 2024)

CosmicSting (CVE-2024-34102) is an XML external entity injection in the REST API that lets an unauthenticated attacker read files such as env.php and, chained with a separate glibc bug, execute code. The bulletin’s priority started at 3, was revised from 3 to 2 on June 26, 2024, and later raised to 1 with an isolated patch. Our own checklist notes that a week after the patch, three-quarters of stores were still unpatched. 

SessionReaper (September 2025)

Adobe published APSB25-88 on September 9 with a hotfix for CVE-2025-54236, a CVSS 9.1 REST API flaw allowing customer account takeover. Adobe amended the bulletin on October 22 to say it was aware of exploitation in the wild, and changed the priority to 1 on October 24. Sansec reported that mass attacks began on October 22, about six weeks after the first fix. Six weeks is a long time to hold a “priority 2” patch.

StyleSmuggler (September 2026)

APSB26-146 describes a critical flaw (CVE-2026-75650, CVSS 10.0), exploitable without authentication and leading to arbitrary code execution. Adobe states it is aware of exploitation in the wild. Sansec described it as a Magento and Adobe Commerce zero-day RCE under active attack. The fix is a hotfix, not a monthly patch, so you need both.

What the three have in common

1. Initial priority understates risk. Treat any unauthenticated flaw in a REST API or template engine as urgent, whatever the number says.

2. A patch closes the door but doesn’t clean the house. If your store was exposed before you patched, check for compromise.

3. Extensions can be affected. The 2.4.8-p3 notes ask developers to review REST API constructor parameter validation. Test modules that use REST or GraphQL.

A Patching Routine You Can Repeat Every Month

Monthly patching works best when it’s boring. These timings are our suggestions, not Adobe’s.

The stronger the warning, the shorter the window: hours for exploitation in the wild, days for priority 2 bulletins with unauthenticated critical flaws, and your next maintenance window for the rest.

What to test after every patch

• Guest and registered checkout with every payment method

• Customer login, account pages and the address book

• Admin login, order grid, product edit and import/export

• Promotions, price rules and shipping rates

• Search, layered navigation and category pages

• Transactional emails and cron jobs

• Extensions that touch checkout, customer accounts, REST or GraphQL

After patching, it also helps to confirm that background jobs are healthy. A tool such as our System Health Monitor shows cron, cache, and database status from the admin. It monitors system health, not vulnerabilities, so it complements a security scan.

Cloud, On-Premises or Open Source: Who Patches What?

For edition trade-offs, see our guide to Magento Open Source vs Adobe Commerce.

What If You Can’t Patch Right Away?

• Restrict admin access by IP and enforce two-factor authentication.

• Put a web application firewall in front of the store. It can reduce exposure to known attack patterns, but it’s a stopgap.

• Increase log monitoring until the patch is live.

Need a Hand Keeping Up?

Monthly patching is manageable with a routine and the right team. If you’d rather not run it alone, our Magento support services include security patch updates and cyber-risk monitoring with 24x7 support. Packages start at 20 hours with one-month commitments, and version upgrades are scoped separately. If an upgrade is overdue, our Magento development team can plan it with you.

Related reading: our Magento 2 security checklist and our Magento 2.4.9 guide.

Frequently Asked Questions

How often does Adobe release Magento security patches in 2026?

Monthly, mostly on the second Tuesday, as isolated fixes. A cumulative security patch ships at least once a year in May, and emergency hotfixes can arrive at any time.

What is the difference between a security patch and an isolated patch?

A full security patch (such as 2.4.8-p5) rolls up earlier fixes and arrives as Composer packages. An isolated patch (such as 2.4.8-2026-aug) contains one month’s fixes and is applied as a patch file.

How do I know which patch level I’m on?

Check your installed Magento package version in Composer and compare it to the labels in Adobe’s bulletin. Adobe’s Quality Patches Tool can also show applied patches.

Do I need every monthly patch or only the latest?

Because isolated fixes are non-cumulative, apply each month’s patch in order until the annual security patch rolls them up. Check Adobe’s release notes for your version.

Will patches break my extensions?

They can, so test on staging, especially extensions that touch checkout, customer accounts, or APIs. Check the vendor’s compatibility information for your patch level.

Is Magento Open Source 2.4.6 still getting patches?

Based on Adobe’s October 2026 listing, Open Source fixes cover 2.4.9, 2.4.8, and 2.4.7, while licensed Adobe Commerce 2.4.6 still receives a patch. Check the bulletin for your edition.

What should I do if my store may have been exploited before I patched?

Apply the fixes. Then check for admin users. Look for cron entries. Check for modified files. Review logs. Follow the indicators that security researchers publish. If anything looks off, involve a specialist. This helps keep the system safe.