Patching · 2026-06-26

How to Apply a Magento Security Patch (Without a Full Upgrade)

Q: Do I have to upgrade Magento to apply a security patch?

No. You can apply a targeted Quality Patch or isolated hotfix for a specific CVE on your current version. A full upgrade is best long-term but isn't required to close one hole.

Q: How long does applying a patch take?

A targeted patch is minutes plus testing. A patch-level update (e.g. 2.4.6-p3 → 2.4.6-p15) runs composer update + setup:upgrade and should be tested on staging first — budget an hour with a maintenance window.

Q: What if I'm already compromised?

Patching alone won't remove an existing breach. Clean the malware, rotate all secrets, and find the entry point — see our recovery plan.

When Adobe drops a critical Magento patch, the clock starts — attackers reverse-engineer the fix and start scanning within hours. This is the practical, copy-paste guide to applying a Magento security patch safely, including the option to fix a single CVE without a full version upgrade.

First, see exactly which patch you need: run a free MageArgus scan — it detects your version and names the exact patch to apply.

By the numbers

Exploits for patched Magento CVEs appear within hours of disclosure — Sansec / Adobe advisories
You can patch one CVE without a full upgrade — Adobe Quality Patches Tool + isolated hotfixes

Step 1 — back up and use staging

Never patch straight on production. Take a full backup (files + database), then apply and test on staging first:

php bin/magento maintenance:enable
# back up DB + files, then patch on staging, smoke-test checkout, deploy in a window

Step 2 — confirm your exact version

The right patch depends on your branch. On the server:

bin/magento --version    # e.g. 2.4.6-p3

Remotely the version isn't fully exposed — see how Magento patches work for the branch→patch mapping.

Step 3 — apply the patch (pick one)

Targeted Quality Patch (no full upgrade):

composer require magento/quality-patches
vendor/bin/magento-patches status
vendor/bin/magento-patches apply <PATCH_ID>

Or move to the latest patch level on your branch:

composer require magento/product-community-edition=<your-branch-fix> --no-update
composer update --with-dependencies
bin/magento setup:upgrade && bin/magento setup:di:compile

For actively-exploited bugs, Adobe also ships an isolated hotfix you can patch -p1 < on top of your current version immediately.

Step 4 — verify and clean up

Flush caches, re-enable the store, and confirm the fix:

bin/magento cache:flush
php bin/magento maintenance:disable
bin/magento --version

For CosmicSting specifically, also rotate the encryption key (bin/magento encryption:key:change) and audit for rogue admins/tokens — a stolen key stays valid after patching.

Frequently asked questions

Do I have to upgrade Magento to apply a security patch?