Adobe Commerce patch cadence: how to plan maintenance windows without downtime surprises
Plan Magento 2 / Adobe Commerce patching around Adobe's cadence, using a hosting-first checklist that reduces downtime risk.
Key Facts
Planned Schedule
Adobe publishes planned dates for patch announcements for supported release lines.
SourceSecurity & Reliability
Patch releases are opportunities to keep the platform secure, reliable, and performant.
SourceQuality Patches
If you are eligible, quality fixes can be accessed via Support or the Quality Patches Tool while in support.
SourceRepeatable Process
A consistent internal routine (staging → production) reduces patch-day surprises.
Practical guidanceUpdate (October 2026): how often Adobe Commerce bulletins actually land
Adobe published six Adobe Commerce security bulletins in 2025, and seven so far in 2026 including one out-of-band emergency fix (7 September). Most fall on the second Tuesday of a month, but not every month gets one: in 2026 the scheduled bulletins came in March, May, July, August, September and October. July's bulletin, APSB26-73, included a CVSS 10.0 unauthenticated RCE fix, and the out-of-band APSB26-146 arrived with no notice. Adobe's patch release schedule commits only to a minimum of one security release a year for each supported release line, so there is no fixed monthly date to count on. The practical routine: check for a bulletin on the second Tuesday of each month, book a short review window after each one that lands, and keep a fast-track route ready for emergency fixes. Bulletins only help stores on supported release lines: if you are still on Magento 2.4.6, regular support ended 11 August 2026.
Most bulletins land on a second Tuesday. Book a review window after each one, and keep a fast track for emergencies.
What the cadence means
Adobe publishes a patch release schedule so teams can plan. The main win is not the exact day: it is the ability to reserve capacity for review, testing, and deployment every month.
Treat Adobe's cadence as a recurring capacity booking: review → test → deploy.
Choosing a maintenance window
Pick a predictable low-traffic window and keep it short. Consistency helps you build muscle memory: same steps, same sign-offs, and fewer last-minute differences between staging and live.
Consistency beats heroics: same window, same steps, fewer surprises.
Staging parity checklist
Match production as closely as possible:
- PHP version and extensions
- Composer dependencies
- Redis and session storage
- Varnish / full-page cache behaviour
- Search stack configuration
- Cron schedule and queue consumers
- File permissions and deploy mode
If parity drifts, patching becomes guesswork.
Parity is your insurance policy. Drift is what causes late-night rollbacks.
Production release checklist
A practical, repeatable flow:
- Confirm backup and rollback options.
- Deploy to staging and run smoke tests (home, PDP, add-to-cart, checkout, admin login).
- Schedule production deployment.
- Deploy, warm caches, reindex where appropriate, and verify key journeys.
- Monitor logs and performance for the next hour.
Warm caches and verify checkout immediately; most issues surface fast.
Hosting considerations
Most patch problems are not "code" problems. They are environment problems. Resource headroom, correct caching layers, reliable cron, and clear observability are what keep patching routine.
Resource headroom + observability is what keeps patching routine.
Next step
If you want patching to be boring (in a good way), use hosting designed for Magento:
Dedicated Magento Hosting UK →
If patching is painful, the platform is usually the culprit.