Adobe Commerce version and end-of-support matrix

Source: Adobe’s lifecycle policy, last updated by Adobe on September 18, 2026. Adobe’s page is the authority. This table is a copy kept in one place on our site, and if the two ever differ, believe Adobe’s.

To see where you stand, run the command below on the server. It prints the installed version, which may include a patch suffix such as -p10.

bin/magento --version

• Standard support. Three years from general availability, with quality fixes, security patches and on-call support. Critical security hotfixes go to customers on any supported version.
• Extended support. One extra year at no cost for 2.4.6 and 2.4.7, on Adobe’s stated terms. For 2.4.8 and 2.4.9, Adobe has not yet set a date.
• Security-only period. A one-time period for 2.4.4, 2.4.5 and 2.4.6, which Adobe says cannot be extended. You get isolated security fixes and no quality fixes, so a bug that is not a security issue stays yours.
• Cloud deadline. This applies to Commerce on Cloud only. From June 1, 2027, Adobe will stop maintaining environments on unsupported versions, and may suspend their traffic. A self-hosted store has no such switch, but it does carry the same security exposure.

Adobe says it supports only the combinations it lists, so a version decision is also a server decision. These are the latest patches on each line, from the on-premises column of Adobe’s system requirements, with Cloud differences noted.

On the on-premises column, Elasticsearch 8 is also listed for 2.4.8-p5 and 2.4.7-p10. It is not listed for 2.4.9 and is marked not supported for 2.4.6-p15.

Comparing the last two patches of the older lines shows something that a date table hides. A security patch can change your stack requirements:

• MySQL. 2.4.7-p9 and 2.4.6-p14 list MySQL 8.0 for on-premises. 2.4.7-p10 and 2.4.6-p15 mark MySQL as not supported. Adobe gives the reason: MySQL 8.0 reached end of support on April 30, 2026, and newer MySQL major versions are not supported for 2.4.4 through 2.4.7. It advises on-premises customers to move to a compatible MariaDB.
• Redis. The same two earlier patches list Redis 7.2 alongside Valkey. The latest ones list Valkey 8.1 and mark Redis as not supported.
• Elasticsearch. Elasticsearch 7.17 reached end of support on January 15, 2026, and Adobe recommends moving to a compatible OpenSearch.

So applying the newest patch on a store that runs MySQL, Redis or an old Elasticsearch can take you outside what Adobe lists as supported, even though you moved no further than a patch number. Plan those infrastructure changes with the patch, and rehearse them on a copy of the store.

PHP has its own calendar, and Adobe’s page notes that it does not patch third-party dependencies once they reach end of life. Here is the highest PHP each latest patch lists, next to the date that PHP branch stops getting security fixes from php.net.

The row to read closely is 2.4.6. Its Commerce dates run into 2028, but the newest PHP it lists ends on 31 December 2026. Adobe’s page flags PCI compliance risk for PHP 8.1 and for PHP 8.2 from the end of 2026, and says the merchant is responsible for assessing compliance with a qualified security assessor.

This is general guidance from the dates and requirements above. It does not account for your extensions, which often set the real limit. What an upgrade involves covers how to find that out.

Adobe’s monthly isolated patching policy adds a step many upgrade plans leave out. Patches come on the second Tuesday of each month, and some rules matter:

• Cloud customers receive them through Cloud Patches for Commerce, applied automatically on deployment.
• On-premises and Open Source installs apply standalone patch files by hand. They are not Composer packages.
• You must be on the latest -p release of your line, because that is the only baseline they are tested against.
• They are not cumulative and must be applied in order, so skipping months creates a backlog.
• The yearly -p release remains the cumulative baseline and includes earlier isolated fixes.

Critical fixes can also arrive outside that schedule. Adobe’s October 13, 2026 bulletin notes that the out-of-band hotfix from September is not bundled in the October patch and has to be applied separately. Someone needs to read each bulletin.

Adobe’s lifecycle page describes Adobe Commerce and does not mention Magento Open Source, so we have not claimed these dates for it. The two share release numbers, and Adobe’s security bulletins cover both. For the practical differences, see Magento Open Source vs Adobe Commerce.

Adobe Commerce as a Cloud Service sits outside this table. Adobe manages the platform and applies updates continuously, after a 30-day window to evaluate them in a sandbox. Adobe’s lifecycle page recommends either moving to it or moving to a supported version before extended support ends. It is not a like-for-like move, because custom logic has to be built with APIs and separately hosted applications, and Luma storefronts are not supported.

The data sits in one file on our site and comes straight from Adobe’s lifecycle policy, system requirements and released-versions pages. PHP dates come from php.net. We checked them all on 30 October 2026, and the date at the top of the page shows the last update. Adobe’s own page changes without notice, so check it before you commit to a date.

This page is reference work. It reports Adobe’s dates and our reading of them, not results from a store of yours. Most of our work is delivered under NDA, so many projects cannot be named. We have no published Adobe Commerce case study on this site, so the projects below are the nearest work we can show, and they are not Adobe Commerce builds.

For help with a move, see our Adobe Commerce development services, which are quoted after an assessment.