Adobe Patched Magento Versions It Stopped Supporting. Open Source Stores Below 2.4.6 Got Nothing.

By Scott Bissett  ·  Published: September 8, 2026  ·  EOL Watch — news analysis  ·  Verified against Adobe's security bulletin APSB26-146 and Adobe Commerce lifecycle table, Sansec's disclosure and CISA's catalog alert (all read September 8, 2026). Every lifecycle date below is checked against the data layer at every build.

The headline everywhere is “CVSS 10.0 Magento zero-day, patch now.” The half that decides what happens to your store is which version you run. CVE-2026-75650, named StyleSmuggler by Sansec, who found it, lets an unauthenticated attacker execute arbitrary code on an affected installation. Sansec logged the first exploitation at 22:20 UTC on September 4, three days before Adobe's emergency hotfix, and has since watched attackers drop a Rust backdoor that hides as a system daemon and a PHP web shell under the product image cache. CISA added it to the Known Exploited Vulnerabilities catalog on September 8, 2026.

Adobe's bulletin APSB26-146, published September 7 and updated the next day, and its urgent-action knowledge base article do two things that matter for lifecycle. They list Adobe Commerce 2.4.4 through 2.4.9 as affected and ship the VULN-39341 hotfix for all six lines, including two whose extended support Adobe had already closed. And they list Magento Open Source 2.4.6 through 2.4.9 as affected, stopping at 2.4.6. The same code, the same flaw, and the free edition's list is two versions shorter. The reason is a support window, and it is the story.

One flaw, two editions, two answers

Affected and hotfix columns are copied from Adobe's bulletin. Support dates are from Adobe's Commerce lifecycle table, which our Magento page is reconciled against; Open Source security maintenance for 2.4.4 and 2.4.5 ended earlier, on November 25, 2024. The EOL Risk Score is live and rewritten at every build.

Why Adobe patched two versions it had stopped supporting

Adobe's lifecycle table has a column most readers skip: after extended support ends, Commerce 2.4.4 and 2.4.5 enter a security-only period that Adobe lists as running to May 2027. Extended support for 2.4.4 closed on April 14, 2026 and for 2.4.5 on August 11, 2026; the security-only window is what still obliges Adobe to ship a fix when a 10.0 is being exploited. That is why the hotfix table reaches back to 2.4.4 for Commerce customers.

Magento Open Source has no such column. Its security maintenance for 2.4.4 and 2.4.5 ended on November 25, 2024, and Adobe's affected-versions list for the free edition begins at 2.4.6. Adobe has not said those two Open Source lines are safe; it has said nothing about them at all, which for a flaw that Sansec reproduced on clean installs of three neighbouring versions is not reassurance. An Open Source store on 2.4.4 or 2.4.5 has no hotfix to apply and no vendor statement to lean on. The only supported answer is an upgrade to a line Adobe still lists, which today means 2.4.7 or later if the store wants a runway past next August.

What CISA's listing means

CISA's alert of September 8, 2026 added four entries to the catalog: this one, described as an “Improper Neutralization of Special Elements Used in a Template Engine Vulnerability” in Adobe Commerce and Magento, alongside two Microsoft Windows flaws and one in N-able N-central. A KEV listing is CISA's confirmation of exploitation in the wild, and under Binding Operational Directive 26-04 federal agencies must prioritise rapid remediation on publicly exposed assets. For everyone else it is the clearest available signal that the attackers moved first: the catalog entry came one day after the hotfix and four days after Sansec's first sighting.

It is not on our Exploited & Unpatchable feed, and it should not be. That feed is for exploited vulnerabilities whose affected versions will never receive a fix. Adobe fixed every version it lists as affected. Open Source 2.4.4 and 2.4.5 sit outside the list, not inside it without a patch, and the feed does not guess.

What to do this week

On Commerce or Open Source 2.4.6 to 2.4.9: apply the VULN-39341 hotfix from Adobe's bulletin now, then follow Sansec's advice and rotate the encryption key and everything it protected: admin passwords, REST, SOAP and GraphQL integration tokens, OAuth secrets, payment gateway credentials, database credentials and deploy keys. The first exploitation predates the hotfix by three days, so a patched store is not the same as an uncompromised one; look for the web shell under pub/media/catalog/product/cache/ and for processes named like fc-cache or chronyd that are not the real thing. Note that 2.4.6 itself left standard support on August 11, 2026; the hotfix is a bridge, and the destination is 2.4.7 or later.

On Commerce 2.4.4 or 2.4.5: the hotfix exists for you under the security-only period. Apply it, do the same credential rotation, and treat May 2027 as the end of the road rather than a comfort.

On Open Source 2.4.4 or 2.4.5: there is no hotfix and Adobe's policy means there will not be one. Upgrade to a listed line and apply its hotfix. Until that lands, keep the admin off the internet, put the storefront behind a web application firewall that can block the exploit pattern, and rotate credentials as above, because the versions next to yours were exploitable before anyone knew.

Whichever edition: check your version against the live table on our Magento page, where every date is reconciled against Adobe's lifecycle table at each build, and read the full Magento release history for the three support tiers and how Open Source and Commerce differ.

Frequently Asked Questions

Related

• Magento — every version with live status, reconciled against Adobe's lifecycle table
• Magento release history and end of life — the three support tiers, Open Source versus Commerce, and Adobe's release schedule
• Exploited & Unpatchable — the feed of exploited CVEs whose affected versions will never receive a fix, and why this one is not on it
• JFrog patched every supported Artifactory branch in a day — the same shape of story, a week earlier