Insights
Adobe Commerce and Magento Security Bulletins: 2020 to 2026 Timeline
Adobe has published 35 security bulletins for Magento and Adobe Commerce since January 2020, fixing 313 CVEs between them, and 32 of the 35 included at least one vulnerability Adobe rated Critical. Every Magento 2 bulletin has applied to Magento Open Source as well as Adobe Commerce. The timeline below lists each one with its date, severity, CVE count and affected versions, taken from Adobe's own pages on 13 October 2026; Adobe's October 2026 bulletin had not been published when we checked.
2026 counted to 13 October.
Every Magento security bulletin, 2020 to 2026
"Highest severity" is the most serious rating in each bulletin's vulnerability table. "Affected" summarises the newest affected version on each line, and earlier versions are affected too. Out-of-band bulletins are emergency releases outside Adobe's normal schedule.
| Bulletin | Published | Highest severity | CVEs | Affected (summary) |
|---|---|---|---|---|
| APSB20-02 | 28 Jan 2020 | Critical | 6 | 2.3.3, 2.2.10; also Magento 1 |
| APSB20-22 | 28 Apr 2020 | Critical | 16 | 2.3.4, 2.2.11; also Magento 1 |
| APSB20-41 | 22 Jun 2020 | Critical | 2 | Magento 1 only (the final Magento 1 patches) |
| APSB20-47 | 28 Jul 2020 | Critical | 4 | 2.3.5-p1 |
| APSB20-59 | 15 Oct 2020 | Critical | 9 | 2.4.0, 2.3.5-p2 |
| APSB21-08 | 9 Feb 2021 | Critical | 18 | 2.4.1, 2.4.0-p1, 2.3.6 |
| APSB21-30 | 11 May 2021 | Important | 7 | 2.4.2, 2.4.1-p1, 2.3.6-p1 |
| APSB21-64 | 11 Aug 2021 | Critical | 26 | 2.4.2-p1, 2.3.7 |
| APSB21-86 | 12 Oct 2021 | Important | 1 | 2.4.3, 2.4.2-p2, 2.3.7-p1 |
| APSB22-12 | 13 Feb 2022 (out-of-band) | Critical | 2 | 2.4.3-p1, 2.3.7-p2; exploited in the wild |
| APSB22-13 | 12 Apr 2022 | Critical | 1 | 2.4.3-p1, 2.3.7-p2 |
| APSB22-38 | 9 Aug 2022 | Critical | 9 | 2.4.4, 2.4.3-p2, 2.3.7-p3 |
| APSB22-48 | 11 Oct 2022 | Critical | 2 | 2.4.5, 2.4.4-p1, 2.4.3-p3 |
| APSB23-17 | 14 Mar 2023 | Critical | 4 | 2.4.5-p1, 2.4.4-p2 |
| APSB23-35 | 13 Jun 2023 | Critical | 12 | 2.4.6, 2.4.5-p2, 2.4.4-p3 |
| APSB23-42 | 8 Aug 2023 | Critical | 3 | 2.4.6-p1, 2.4.5-p3, 2.4.4-p4 |
| APSB23-50 | 10 Oct 2023 | Critical | 9 | 2.4.6-p2, 2.4.5-p4, 2.4.4-p5 |
| APSB24-03 | 13 Feb 2024 | Critical | 5 | 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 |
| APSB24-18 | 9 Apr 2024 | Critical | 2 | 2.4.6-p4, 2.4.5-p6, 2.4.4-p7 |
| APSB24-40 | 11 Jun 2024 | Critical | 10 | 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8; exploited in the wild |
| APSB24-61 | 13 Aug 2024 | Critical | 23 | 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 |
| APSB24-73 | 8 Oct 2024 | Critical | 22 | 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10; also B2B |
| APSB24-90 | 12 Nov 2024 | Critical | 1 | Commerce Services Connector 3.2.5, not Magento core |
| APSB25-08 | 11 Feb 2025 | Critical | 31 | 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11; also B2B |
| APSB25-26 | 8 Apr 2025 | Important | 5 | 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12; also B2B |
| APSB25-50 | 10 Jun 2025 | Critical | 7 | 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12; also B2B |
| APSB25-71 | 12 Aug 2025 | Critical | 6 | 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13; also B2B |
| APSB25-88 | 9 Sep 2025 | Critical | 1 | 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14; exploited in the wild |
| APSB25-94 | 14 Oct 2025 | Critical | 5 | 2.4.8-p2, 2.4.7-p7, 2.4.6-p12; also B2B |
| APSB26-05 | 10 Mar 2026 | Critical | 19 | 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15; also B2B |
| APSB26-49 | 12 May 2026 | Critical | 15 | 2.4.8-p4, 2.4.7-p9, 2.4.6-p14; also B2B |
| APSB26-73 | 14 Jul 2026 | Critical | 14 | 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15; also B2B and Commerce Events |
| APSB26-92 | 11 Aug 2026 | Critical | 7 | All lines "2026-jul and earlier"; Open Source 2.4.6 to 2.4.9 |
| APSB26-146 | 7 Sep 2026 (out-of-band) | Critical | 1 | All lines "2026-aug and earlier"; Open Source 2.4.6 to 2.4.9; exploited in the wild |
| APSB26-138 | 8 Sep 2026 | Critical | 8 | All lines "2026-aug and earlier"; Open Source 2.4.6 to 2.4.9 |
| October 2026 | Pending | Not published when checked on 13 October 2026, 15:41 BST |
Adobe has revised several bulletins after publication, adding or removing CVEs and raising priorities. The counts above are each bulletin's table as it stood on 13 October 2026.
Magento security patches: the patterns
Since 2024, Adobe has published six bulletins a year, up from four or five, and almost every bulletin includes at least one Critical issue.
| Year | Bulletins | CVEs | Bulletins with a Critical issue |
|---|---|---|---|
| 2020 | 5 | 37 | 5 |
| 2021 | 4 | 52 | 2 |
| 2022 | 4 | 14 | 4 |
| 2023 | 4 | 28 | 4 |
| 2024 | 6 | 63 | 6 |
| 2025 | 6 | 55 | 5 |
| 2026 (to 13 October) | 6 | 64 | 6 |
| Total | 35 | 313 | 32 |
How we worked it out: we counted the bulletins Adobe lists for Magento and Adobe Commerce in each calendar year, added up the distinct CVE IDs in each bulletin's vulnerability table, and counted the bulletins whose most serious rating is Critical. 32 of 35 is 91%. Two bulletins were out-of-band emergency releases: APSB22-12 in February 2022 and APSB26-146 in September 2026. Since August 2026, Adobe says it may group some internally found issues under one CVE, so CVE counts from then on are not directly comparable with earlier years.
Notable bulletins
- APSB22-12 (February 2022): an out-of-band fix for a vulnerability Adobe said was being exploited in the wild.
- APSB24-40 (June 2024): Adobe later raised its priority to the highest level after one of its vulnerabilities was exploited in the wild.
- APSB25-88 (September 2025): one vulnerability, which Adobe later marked as exploited in the wild and raised to its highest priority.
- APSB26-49 (May 2026): see our APSB26-49 guide.
- APSB26-73 (July 2026): see APSB26-73.
- APSB26-92 (August 2026): see APSB26-92.
- APSB26-146 (September 2026): an out-of-band fix for the StyleSmuggler zero-day, rated Critical and exploited in the wild. See StyleSmuggler.
- APSB26-138 (September 2026): the regular September bulletin, the day after StyleSmuggler. See APSB26-138 and StyleSmuggler.
How Magento security updates are released now
Since July 2026, Adobe has shipped its security fixes as monthly isolated patches on top of each line's latest release, rather than as new -pN releases.
The bulletins from August 2026 list affected versions as "2026-jul and earlier" and "2026-aug and earlier", naming the monthly patch rather than a -p number. A store applies the monthly patches in order on top of the latest -p release for its line. For which versions still receive patches, and the latest patch for each, see our Magento version and patch tracker. For how the older -pN releases work, see Magento security patches (-pN) explained, and for planning around them, Adobe Commerce patch cadence.
How Fully Managed patching works
On our Fully Managed plan, £169 a month + VAT, we apply Magento security patches for you: staging first, then production in an agreed window, with a rollback plan. If a patch conflicts with your custom code, we stop and hand it to your developer. On our other plans, your developer applies Magento patches on the staging copy and we coordinate production. Operating system and server stack security updates are included on every plan. See Magento upgrades and security patching and Magento managed services.
Sources
All accessed 13 October 2026, between 15:35 and 15:41 BST.
- Adobe: Security bulletins for Adobe Commerce (Magento)
- Adobe Trust Center: Security bulletins and advisories
- Each bulletin page, linked from its ID in the table above.
Frequently asked questions
Want Magento patches applied for you?
Our Fully Managed plan applies Magento security patches on staging first, then to production in an agreed window.