:quality(75))
On January 6, 2026, Adobe changed the Adobe Commerce patch release schedule. Effective immediately, security patches ship monthly on their own, and May becomes the annual window for the bigger stuff.
What it replaces
Adobe Commerce previously ran quarterly patch releases — February, May, August and November — bundling security fixes, bug fixes and feature enhancements together. That left merchants with an awkward choice: take everything, or delay a security patch because the features shipped alongside it needed testing you had not scheduled. Plenty of merchants chose to wait, and fell behind on security as a result.
The new model
Under the monthly cycle, Adobe releases isolated security patches every month outside May. Security fixes only — no feature changes, no breaking API modifications. May remains the annual release window for major features and improvements.
Versions and end-of-support dates
Monthly patches only reach versions Adobe still supports, so the schedule is half the picture — the other half is where your version sits in its lifecycle. These are the dates from Adobe's lifecycle policy:
Version | Released | Standard support ends | Extended support ends |
|---|---|---|---|
2.4.9 | 12 May 2026 | 31 May 2029 | Not yet announced |
2.4.8 | 8 April 2025 | 31 May 2028 | Not yet announced |
2.4.7 | 9 April 2024 | 31 May 2027 | 31 May 2028 |
2.4.6 | 14 March 2023 | 11 August 2026 | 31 August 2027 |
2.4.5 | 9 August 2022 | 12 August 2025 | 11 August 2026 |
2.4.4 | 12 April 2022 | 12 April 2025 | 14 April 2026 |
The May 2026 window worked exactly as advertised: 2.4.9 arrived on 12 May alongside patch releases for every supported line back to 2.4.4.
As of August 2026 the table splits cleanly. 2.4.8 and 2.4.9 sit comfortably in standard support, and 2.4.7 has under a year of it left. 2.4.6 crossed into extended support — a free extra year Adobe gives both 2.4.6 and 2.4.7 — on 11 August 2026. 2.4.4 and 2.4.5 are down to isolated security fixes, a one-off concession that ends on 31 May 2027 and covers nothing else. If you're on either, the upgrade conversation is overdue.
What changes month to month
Security patches now arrive monthly rather than quarterly, which shortens the gap between a vulnerability being disclosed and a patch being available to you. Monthly security review windows become a routine operational task rather than a quarterly event that competes with everything else on the roadmap.
What changes for your team
A security-only patch carries minimal regression risk, so the deployment decision is easier and the testing burden is smaller. Many teams will automate monthly patching entirely and reserve human review for the annual May release. That is a real reduction in work, and it scales down as well as up — a two-person team benefits from it as much as a twenty-person one.
What this means for you
The schedule is in effect now. Plan a monthly security patch review cycle, and treat May as the release that needs proper planning, testing and a date in the calendar. If we manage your platform, we will handle the monthly cadence and come to you for May.