Adobe Commerce and Magento 2.4.5 and 2.4.6 reach end of life. What does this mean for your business?

Adobe Commerce and Magento 2.4.5 and 2.4.6 end of life (EOL) happens this week, with the brand releasing patch updates on 11 August 2026. Not everyone loses support in the same way at the same time, though – and the difference matters more than most merchants realise.

Support for these platforms isn’t a single cliff-edge. It’s a staircase: standard support, then a further year of extended support for some customers, then a narrower window of security-only fixes, then nothing. Which step you’re on today depends on which product you’re licensed under, and which version you’re running. Get that wrong, and you’ll either panic about a deadline you don’t have yet, or relax about one you’ve already missed.

What end of life actually means for 2.4.5 and 2.4.6 by product

If you’re on Magento Open Source 2.4.6, this is your deadline. Open Source has no extended support-path, so 11 August 2026 was the day quality and security patches stopped in full.

For Adobe Commerce 2.4.6, Tuesday marked the end of standard support, and Adobe has moved you into a free extended year that still includes quality and security patches. That runs until 30 August 2027. After that, you drop to a security-only period, described in Adobe’s lifecycle policy as “limited, isolated security fixes” with no quality patches, running until 31 May 2028. After that, nothing.

Here’s how the three end-of-life versions stack up against each other:

2.4.4: Open Source Support ended 12 April 2025. Adobe Commerce’s extended support ended 14 April 2026. Security-only fixes continue until 31 May 2027
2.4.5: Open Source support ended 12 August 2025. Adobe Commerce’s extended support ends 12 August 2026. Security-only fixes continue until 31 May 2027.
2.4.6: Open Source support ended 11 August 2026. Adobe Commerce’s extended support ends 30 August 2027. Security-only fixes continue until 31 May 2028.

Everything newer is still on standard support with no such staircases to worry about yet:

2.4.7 until 31 May 2027
2.4.8 until 31 May 2028
2.4.9 until 31 May 2029

Have you missed your Adobe Commerce 2.4.5 end of support deadline?

2.4.5 is where the staircase analogy catches people out. If you’re on Magento Open Source 2.4.5 your support ended back on 12 August 2025 – over a year ago. Whether that registered at the time or not, you’ve been unpatched since then.

If you’re on Adobe Commerce 2.4.5, you’ve had a free extra year of quality and security patches – and it runs out 12 August 2026. After that, you move into the security-only tail until next May, then nothing. So, if you’ve been telling yourself “we’re fine, we have another year” the truth is, you already had one, and it’s ended.

Why security-only doesn’t mean safe

It’s tempting to relax the moment you land on any kind of Magento security patch, even the narrow kind – but it’s worth being precise about what you’re actually getting. Adobe’s own language for the final tier, set out in its security enforcement policy is clear: “limited, isolated security fixes”.

No quality patches, no guarantee that a given vulnerability gets covered – and you’re on a deadline: eventually none of it gets covered.

This is why it matters:

In 2024, security researchers found a critical XXE vulnerability in Adobe Commerce and Magento: CosmicSting, tracked as CVE-2024-34102 score 9.8. Once it went public, attackers used it against more than 4,000 stores, including Ray-Ban, National Geographic and Segway. Adobe had already shipped a fix. Most of those stores got hit anyway, because patching Magento isn’t something retail teams get around to the week a fix lands – even when that fix exists.

Now, picture the same bug landing on a release line that’s past its security-only window entirely, when no fix is coming regardless of how fast you’d move. That’s not a future risk for 2.4.4 and Open Source 2.4.5 merchants: that’s where you are now.

Unsupported doesn’t mean broken: it means undefended.

Why this end of life support lands badly right now

August is exactly when serious retailers start locking down for peak trading season.

Freeze windows, code review, load testing – the whole run-up to Black Friday and Christmas: all of it assumes a platform that’s still being actively maintained beneath you. Heading into that period on a version that’s lost its quality patches, or is about to, means every incident during your busiest trade week is one Adobe has less obligation to help with.

We hear a version of the same conversation from merchants on 2.4.4 to 2.4.6 most weeks: they know they need to move, the deadline’s been on a roadmap somewhere for a year, and nothing’s actually started. That’s not a criticism: upgrades compete with everything else on a busy team’s plate, and it’s easy for a date that felt far off to arrive anyway. But ‘we know’ and ‘we’ve started’ are different places to be in when heading into peak.

What an Adobe Commerce upgrade actually takes

A clean Magento upgrade to a currently supported version, done a version or two at a time, on a well-maintained store, typically runs two to four weeks. Leave it until you’re jumping several versions at once, with extensions and custom code that haven’t been touched in years, and that stretches to six or ten.

Most of that time doesn’t go on the upgrade itself; it goes on auditing what you’ve got, fixing the extensions and code that don’t survive the jump and testing properly before launch.

The gap between those two numbers is the real cost of waiting.

Merchants who upgrade roughly every year spend less, less often, and never have this conversation in a panic. Merchants who wait three years get the six-to-ten week version, at the worst possible time of year to be doing it.

For most stores currently on 2.4.5 or 2.4.6, 2.4.8 is the sensible landing spot: standard support until 31 May 2028, and the longest runway before you’d need to think about the next move. If you’re on 2.4.4 or Open Source 2.4.5, the same logic applies, just with a version or two more to get through first.

What to do this week

Four things, in order, before you do anything else:

Confirm your exact version and licence. Don’t go on memory. Teams get this wrong more often than you’d expect.
Get your exact support dates in writing. Use the above as a starting point, then ask your hosting/solution partner – or Adobe – to confirm which tier you’re on today and when it ends. Extended support eligibility can vary by contract, so don’t assume you’re covered until someone confirms it in writing.
Audit your extensions and custom code now, not after you’ve booked the work. This is roughly 40% of total upgrade effort on a typical mid-market store, and it’s where timelines blow out. Get a list of every third-party extension, its current compatibility status, and anything custom sitting on top of core.
Book your slot before your peak freeze window opens. Most serious retailers start deploying changes a few weeks before Black Friday. If your upgrade isn’t scoped and booked before that window closes, it’s not happening until January – and you’ll spend the busiest trading period of the year on an unsupported or thinly supported version.

If you’re already past every tier, Open Source 2.4.4 or 2.4.5 treat this as urgent, rather than routine.

There’s no vendor patch coming for anything new, so a web application firewall or virtual patching from a security vendor is worth putting in place as a stop gap while the upgrade itself gets planned and built.

How JH can help you with Adobe Commerce and Magento 2.4.5 and 2.4.6 end of life today

Tell us where your store actually sits (version, licence, extensions, when anyone last touched the codebase) and we’ll give you a straight answer on what getting to a supported version takes – in weeks and in cost – before you’re locked into peak trading freeze.

Adobe Commerce and Magento 2.4.5 and 2.4.6 have reached end of life. Whichever step of that staircase you’re standing on, it just got narrower. Use what’s left of it wisely.