Magento monthly security patches in 2026: apply them in order

Adobe now ships Magento security fixes every month. On the second Tuesday of each month (Patch Tuesday), Adobe may publish an isolated security patch for every supported 2.4.x line, and these patches are not cumulative: you must be on the latest -p release for your line and apply every monthly file in order. If you run Magento Open Source or Adobe Commerce, that changes how you schedule maintenance for the rest of 2026.

This guide explains the new model, what July, August and September 2026 delivered, how to apply and verify the files, and what to do about the actively exploited CVE-2026-75650 hotfix released on 7 September.

What changed: one cumulative release a year, isolated fixes every month

For years Magento followed a predictable rhythm of -p1, -p2, -p3 security releases installed through Composer. Adobe's Monthly Isolated Security Patching Policy replaces that rhythm with two layers:

• Annual -pN releases. Released once a year for all supported release lines and installed through Composer. They are cumulative and fold in earlier security, compliance and quality hotfixes.
• Monthly isolated patches. Small code diffs, usually delivered as a ZIP, for vulnerabilities that cannot safely wait for the next annual release. They arrive on Patch Tuesday, the second Tuesday of the month.

Adobe's stated reason is speed. AI-assisted analysis can find flaws in large codebases much faster than before, so fixes now ship as soon as they are ready rather than waiting for a quarterly train.

The policy applies to Adobe Commerce on cloud infrastructure, Adobe Commerce on-premises and Magento Open Source. Bulletins now name fixed builds with a date suffix, such as 2.4.9-2026-jul, instead of a new -p number.

The 2026 bulletins so far

If the cadence holds, the next scheduled Patch Tuesday is 13 October 2026. Adobe lists release dates on its release schedule page, so treat that date as a planning assumption rather than a promise of a bulletin.

Step 1: get onto the right baseline

Isolated patches are tested only against the latest security-only -p release of each line. Adobe's released-versions page lists these as the current baselines:

Check what you run before anything else:

bin/magento --version
composer show magento/product-community-edition 2>/dev/null | grep versions
composer show magento/product-enterprise-edition 2>/dev/null | grep versions

If you are behind, upgrade to the baseline through Composer first. Patching an older patch level is unsupported and often fails to apply.

One limitation matters for Open Source stores: Adobe's September 2026 bulletin notes say Magento Open Source merchants can download isolated patches only for 2.4.7 and later. If you run Open Source 2.4.6 or older, plan an upgrade now.

Step 2: download and apply the files in order

Each monthly ZIP is named after the line and month, for example 2-4-9-sep-2026.zip or 2-4-7-p10-sep-2026.zip. Download it from your account at account.magento.com; shared-access users need download privileges from the licence holder. Inside are separate files per component, such as CE, EE and B2B. Apply only the files that match the components you have installed.

Order matters because each month builds on the last. For a 2.4.6-p15 store running Commerce, Adobe's documented order is: previous month CE, previous month EE, current month CE, current month EE, then the matching B2B files if you use B2B. For 2.4.9, the September file follows the July and August files.

On-premises and Magento Open Source

Adobe's support article gives a plain patch workflow. Upload the file to the Magento root, then run:

cd /var/www/magento
patch -p1 < 249-2026-09-001-CE.patch
# If the paths do not match, Adobe suggests trying -p2 instead of -p1
bin/magento cache:flush

The file name above is an example of the naming used inside the ZIP. Use the exact names from your download. Adobe also allows refreshing the cache under System > Cache Management instead of the CLI command.

A useful habit that is not in Adobe's article: run GNU patch with --dry-run first. It reports whether every hunk applies without changing any file.

Adobe Commerce on cloud infrastructure

Check the Cloud Patches for Commerce release notes first. When the fix is already in the latest cloud-patches update, Adobe warns that applying the isolated file as well can cause installation failures. If you do need it, copy the file into m2-hotfixes and deploy:

mkdir -p m2-hotfixes
cp ~/Downloads/249-2026-09-001-CE.patch m2-hotfixes/
git add -A
git commit -m "Apply 249-2026-09-001-CE.patch"
git push origin

Step 3: verify with the Commerce Version Tool

Version numbers no longer tell you whether a store is safe, because the fixes ship outside Composer. Adobe's answer is the Commerce Version Tool (CVT), which reads patch metadata and reports what is installed, what is missing and the status of each CVE. CVT is included only in the July 2026 isolated patch, and installs to vendor/bin/patch-status.

php vendor/bin/patch-status --version   # is CVT installed?
php vendor/bin/patch-status             # applied_patches, missing_patches, vulnerability_status

Each CVE is reported as PROTECTED, VULNERABLE or UNKNOWN. If the command is missing, apply the July 2026 CE file first. On Adobe Commerce on cloud infrastructure without CVT, the Quality Patches Tool can check one patch at a time:

vendor/bin/magento-patches -n status | grep "246p15-2026-07-001-CE\|Status"

CVT also produces machine-readable output, so you can run it in CI and fail a deployment that reports a missing patch.

The CVE-2026-75650 hotfix needs its own plan

APSB26-146 is different from the monthly files. It fixes an unauthenticated remote code execution flaw that Adobe says has been exploited against Commerce merchants. It covers Adobe Commerce 2.4.4 to 2.4.9 and Magento Open Source 2.4.6 to 2.4.9, including the July and August builds. The September isolated patch does not contain it, so install it separately, either before or after September's file.

The hotfix ships as VULN-39341 files: a composer-patches ZIP for current baselines, and separate .patch.zip files for older patch levels such as 2.4.8-p1 or 2.4.7-p5. Adobe treats patching as only part of the response. Its announcement lists these follow-up steps:

1. Apply the hotfix, enable maintenance mode and disable cron.
2. Rotate the encryption key.
3. Rotate all Admin passwords, and regenerate REST, SOAP and GraphQL integration tokens and OAuth client secrets.
4. Rotate payment gateway, shipping, tax and other third-party API credentials at the provider.
5. Rotate database credentials, SSH and deploy keys, and service-account credentials.
6. Flush the cache, re-enable cron and leave maintenance mode.

Adobe is explicit that rotating the encryption key alone does not invalidate credentials that may already have leaked. Each secret has to be changed where it is issued.

Gotchas we see teams hit

• Skipping a month. Isolated patches do not bundle earlier months. A store that missed August cannot jump straight to September.
• Composer reinstalls. A patch applied with patch -p1 modifies files under vendor/. A clean composer install on a new server will not include it unless your build reapplies the patch. Commit the files and apply them in your deployment pipeline.
• Wrong component file. Applying the EE file to an Open Source store, or a B2B file without B2B installed, will fail. Match each file to an installed component.
• Treating 2.4.6 as current. Standard support for 2.4.6 ended on 11 August 2026. Patches still arrive, but the clock is running.
• Extensions that override patched classes. A preference or rewrite in a third-party module can silently bypass a fix. Re-test checkout, file uploads and Admin login after every patch.

What to do next

1. Today: confirm your version and apply the APSB26-146 hotfix if you have not, then work through the credential rotation list.
2. This month: bring every store to its -p baseline and apply July, August and September in order. Verify with patch-status.
3. Ongoing: book a short maintenance window after the second Tuesday of every month, subscribe to Adobe security bulletins and add CVT to CI.
4. This year: if you are on 2.4.6 or older, schedule the move to 2.4.8 or 2.4.9 rather than patching an ageing line.