Adobe Commerce end of life: versions, deadlines and upgrade planning

Adobe Commerce end of life: which versions require action?

Last verified: October 21, 2026.

Adobe Commerce end of life does not switch off a store immediately. It changes the fixes and assistance Adobe provides. Standard support includes quality fixes, security patches and full support. Extended support continues quality and security coverage for specified release lines. The security-only transitional period provides limited isolated security fixes but no quality fixes.

The dates below apply to Adobe Commerce. Magento Open Source may receive related security releases but does not include contractual Adobe Support. Cloud enforcement rules apply only to Adobe Commerce on Cloud PaaS.

• 2.4.4: urgent. Extended support ended April 14, 2026. Security-only coverage ends May 31, 2027.
• 2.4.5: urgent. Extended support ended August 11, 2026. Security-only coverage ends May 31, 2027.
• 2.4.6: plan the upgrade now. Standard support ended August 11, 2026. Extended support ends August 31, 2027. Security-only coverage then runs until May 31, 2028.
• 2.4.7: plan within the next year. Standard support ends May 31, 2027. Extended support ends May 31, 2028.
• 2.4.8: supported. Standard support ends May 31, 2028.
• 2.4.9: current release line. Standard support ends May 31, 2029. (experienceleague.adobe.com)

Extended support for 2.4.6 and 2.4.7 is an additional year offered at no extra cost. The security-only period for 2.4.4 through 2.4.6 is a one-time migration window. It is not a permanent support tier. (experienceleague.adobe.com)

Minor-version status is only part of the check. Merchants should also run the latest eligible patch or security-patch release within their line. Adobe explicitly recommends the latest security patch for every supported release. (experienceleague.adobe.com)

What are the risks of running an unsupported version?

Unsupported releases stop receiving some or all new fixes. APSB26-42 offers a useful example. Adobe fixed CVE-2026-27291, a critical stored cross-site scripting issue with a CVSS score of 8.7. Exploitation required authentication, administrator privileges and user interaction. Adobe reported no known exploitation in the wild. The bulletin affected specific patch levels across several Commerce lines, which shows why patch status matters as much as the minor version. (helpx.adobe.com)

The wider stack creates another risk. Oracle's Extended Support for MySQL Database 8.0 ended in April 2026, although Sustaining Support continues indefinitely. Elastic ended support for Elasticsearch 7.17 on January 15, 2026. A supported Commerce line can still become risky when PHP, database, search, cache or queue components fall outside vendor or Adobe-tested combinations. (oracle.com)

Unsupported software does not automatically prove PCI DSS noncompliance. It does make patching, vulnerability management and assessor approval harder. Merchants should review compensating controls with their Qualified Security Assessor.

For Adobe Commerce on Cloud, Adobe has published specific enforcement dates. Environments on 2.4.4 or 2.4.5 must upgrade or migrate by June 1, 2027. The deadline for 2.4.6 or 2.4.7 is June 1, 2028. Dependency deadlines come sooner and also apply to 2.4.8 and 2.4.9. By October 30, 2026, Cloud environments must replace Elasticsearch with OpenSearch and upgrade MariaDB 10.5 or older and RabbitMQ 3.9 or older. Remaining upgrades, including PHP 8.1 or older and Redis 5 or older, are due by May 31, 2027. After a missed deadline, Adobe may suspend Admin access or inbound traffic. Suspended traffic takes the storefront offline. Environments that remain non-compliant may be decommissioned, with all data permanently deleted. (experienceleague.adobe.com)

How to plan an Adobe Commerce upgrade

Start with an inventory of custom modules, themes, Composer constraints, integrations, patches and infrastructure. Confirm the target release's PHP, database, OpenSearch, cache and message-queue requirements. Then run Adobe's Upgrade Compatibility Tool and obtain vendor certification for every important extension. (experienceleague.adobe.com)

Build and rehearse the upgrade with production-like data. Test checkout, payments, webhooks, ERP flows, Adobe Commerce Services, cron, queues, indexers, search and CDN behavior. Include security scans, performance benchmarks and order reconciliation.

Do not treat rollback as a simple code reversal. Database changes, new orders, queued messages and external writes can make rollback lossy. Prepare backups, restore procedures, a roll-forward plan and business reconciliation steps.

A software architecture audit can reveal whether an upgrade is still the best investment. Upgrade when the architecture remains sound and the deadline is close. Modernize selected layers when a few components create most of the risk. Consider replatforming without losing revenue when custom-code volume, operating cost or required features make another major upgrade poor value.

Webalize supports this work through consulting and technical audits, upgrade planning, testing and ongoing maintenance and support. The goal is a secure release with a maintainable upgrade path, not simply a newer version number.