← All articles

Patching · 2026-06-25

Magento Security Patches Explained: APSB Bulletins, Versions & How to Apply

If you run Magento or Adobe Commerce, "just patch it" is easy to say and confusing to do. Which patch? Full upgrade or hotfix? What version are you even on? This guide explains how Magento security patches actually work — APSB bulletins, per-branch patch levels, and the fastest safe way to apply the right one.

Not sure where you stand? Run a free MageArgus scan — it maps your detected version to the exact patch you should apply.

By the numbers
  • Adobe ships scheduled security patches roughly quarterly, plus emergency hotfixes — Adobe Security Bulletins (APSB) cadence
  • Each branch (2.4.4–2.4.8) gets its own patch line, e.g. 2.4.6-p15 — Adobe Experience League security-patch release notes
  • The same CVE is fixed at a different -pN on every branch — e.g. SessionReaper = 2.4.7-p8 / 2.4.6-p13 / 2.4.5-p15 (APSB25-94)

APSB bulletins: Adobe's source of truth

Every Magento/Adobe Commerce security release is documented in an APSB bulletin (e.g. APSB24-40 = CosmicSting, APSB25-94 = SessionReaper). Each bulletin lists the CVEs fixed, the CVSS score, the affected versions, and the fixed version for each branch. The bulletin index is the canonical reference; the per-branch "Security Patch Release Notes" pages list every patch in order.

Per-branch patch levels (2.4.x-pN)

Magento maintains several branches at once — 2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8 — and each gets its own patch series (-p1, -p2, …). A given CVE is patched at a different -pN on each branch. So the right fix depends on your branch:

This is why "upgrade to the latest" and "apply the patch for your branch" are two valid, different paths.

Hotfix / Quality Patch vs full upgrade

You have options, from smallest to largest change:

# Targeted (no full upgrade):
composer require magento/quality-patches
vendor/bin/magento-patches status
vendor/bin/magento-patches apply <PATCH_ID>

# Or update to the latest patch on your branch:
composer require magento/product-community-edition=<your-branch-fix> --no-update
composer update --with-dependencies
bin/magento setup:upgrade && bin/magento cache:flush

Which patch do I actually need?

Three steps:

  1. Find your exact version: bin/magento --version.
  2. Check the APSB bulletins for any CVE whose fixed version on your branch is higher than yours.
  3. Apply the highest applicable patch (or the latest on your branch).

MageArgus does this mapping for you: it detects your version and names the exact patch — e.g. "apply 2.4.6-p15" — in the report. See the 2026 Magento CVE list for the headline bugs to check.

Apply patches safely

Always: back up files and database first, apply on staging, run setup:upgrade + setup:di:compile, smoke-test checkout, then deploy to production in a maintenance window. For CosmicSting specifically, also rotate the encryption key (bin/magento encryption:key:change) — a stolen key stays valid forever.

Frequently asked questions

How do I find which Magento version I'm on?

Run bin/magento --version on the server, or check composer.lock. Remotely, the /magento_version endpoint only reveals the branch (e.g. 2.4) — the exact patch level needs server access or the MageArgus module.

Is a hotfix as good as upgrading?

For closing a specific CVE, yes — the hotfix patches the vulnerable code. A full upgrade additionally brings every other fix and improvement, so plan one eventually, but a hotfix stops the bleeding now.

What's the latest Magento version?

Adobe maintains the 2.4.8 branch as current plus 2.4.x maintenance branches. Always check the APSB bulletin index for the newest patch level for your branch.

Related reading

Scan your store free →