Magento 2.4.6 support ends 11 August 2026. What changes, why Open Source and Adobe Commerce differ, and what to do in the time that is left.
On this page
On 11 August 2026, Magento 2.4.6 reaches the end of its regular support. If you are reading this when it was published, that is a fortnight away.
Most of what has been written about this date says roughly the same thing: support ends, so upgrade now. That advice is not wrong, but it skips the two things that actually determine what you should do. The first is that the deadline does not mean the same thing for every store, because Adobe treats Magento Open Source and Adobe Commerce very differently after this date. The second is that a fortnight is not long enough to upgrade a real store safely, so telling you to “upgrade now” is not a plan.
This article covers what genuinely changes on 11 August, how to work out which side of the line you are on, and what is realistically worth doing in the time that is left. We maintain and upgrade Magento stores for a living, so we have a commercial interest in this topic. We have written it to be useful regardless of who does the work.
Executive Summary
What you will learn: exactly what ends on 11 August 2026, why the answer differs between Magento Open Source and Adobe Commerce, which other versions are expiring at the same time, how long a safe upgrade actually takes, and what to do if you cannot complete one before the date.
Who should read it: store owners, eCommerce managers and IT leads running Magento 2.4.6, 2.4.5 or 2.4.4, and anyone who is not certain which version their store is on.
Why it matters: after a version passes end of support, newly discovered vulnerabilities in it are never fixed. The store keeps working, which is precisely what makes this risk easy to defer. Nothing breaks on 12 August. The exposure simply starts accumulating and never stops.
Effort: around fifteen minutes to establish your position and decide. A full upgrade is typically a 6–14 week project depending on how much custom code and how many extensions you carry.
Key Takeaways
- Magento 2.4.6 regular support ends 11 August 2026. Nothing stops working that day, but security patches stop being issued for that version.
- The critical distinction most coverage blurs: extended support past this date is available to Adobe Commerce customers only. Magento Open Source 2.4.6 gets nothing further.
- If you run Adobe Commerce 2.4.6, you have extended support to 30 August 2027 and more room to plan than the headlines suggest.
- Version 2.4.5 hits the end of its extended support on 12 August 2026, one day later, and 2.4.4 already passed that point on 14 April 2026.
- Two weeks is not enough time to upgrade a real store. Upgrading to 2.4.9 means a server rebuild as much as a code change, because the supported stack moved to PHP 8.5, OpenSearch 3 and Valkey.
- What you can realistically do before the date: confirm your exact version and edition, apply every patch currently available to you, and get a scoped upgrade plan agreed.
- The measurable risk has never been the deadline itself. It is the gap between a patch being published and being applied.
What Actually Happens On 11 August 2026
Nothing visible. Your store does not stop working, your admin panel does not lock, and no warning appears for customers. This is the part that makes the risk so easy to postpone, and it is worth being clear about what does and does not change.
What ends is the flow of fixes. From that date, when a vulnerability is discovered in Magento core code, no patch is produced for the 2.4.6 line. The vulnerability is still published, still discussed publicly, and still exploited. Your store simply never receives the fix. This applies to bug fixes and technical support as well, but security is the part that carries real consequence.
There is also a compliance dimension that tends to surface at the worst moment. Adobe’s own lifecycle documentation flags that running out-of-support software puts PCI compliance at risk. If you take card payments, unsupported software is the kind of thing that becomes a problem during an assessment or, more painfully, during an investigation after an incident. Worth confirming your position with your acquirer or assessor rather than assuming.
The Distinction Almost Every Article Skips
Here is the part that changes what you should actually do, and it is the reason a single deadline produces two very different answers.
Adobe offers an extended support period beyond the standard three year window, which continues to provide quality and security patches for the core application. For 2.4.6 that extended period runs to 30 August 2027, followed by a limited security-only transitional period. That is a full year of additional headroom beyond the date everyone is writing about.
The catch is who qualifies. Extended support is available to Adobe Commerce customers only. It is not available for the Magento Open Source code base. So the same version number produces two entirely different situations:
Two facts decide your whole response: your exact version (including the patch suffix, such as 2.4.6-p15) and your edition. If you hold an Adobe Commerce licence you have until August 2027. If you run Magento Open Source, the wall is 11 August 2026. Do not rely on memory or on what the store was originally built as, because editions and versions both change over a store’s life.
You May Not Be On The Version You Think
Something worth flagging before you plan around 2.4.6: a large number of stores are on older versions than their owners believe, and two other lines are expiring in the same window.
Version 2.4.5 reached the end of its standard support in August 2025 and its extended support ends on 12 August 2026, one day after 2.4.6. Version 2.4.4 passed the same milestone on 14 April 2026, so stores still on it are already receiving nothing. If you have not upgraded in a couple of years, you are more likely to be in this group than on 2.4.6.
| Version | Released | Standard support ends | Extended support ends (Adobe Commerce only) |
|---|---|---|---|
| 2.4.4 | 12 April 2022 | 12 April 2025 | 14 April 2026 (passed) |
| 2.4.5 | 9 August 2022 | 12 August 2025 | 12 August 2026 |
| 2.4.6 | 14 March 2023 | 11 August 2026 | 30 August 2027 |
| 2.4.7 | 9 April 2024 | 31 May 2027 | 31 May 2028 |
| 2.4.8 | 8 April 2025 | 31 May 2028 | Not yet published |
| 2.4.9 | 12 May 2026 | 31 May 2029 | Not yet published |
You can confirm your own version from the command line with bin/magento --version, or from the admin panel footer. If neither is available to you, whoever hosts or maintains the store can answer it in under a minute, and an unwillingness to answer it quickly is itself informative. Our guide on how to choose a Magento development agency covers what else that reluctance tends to indicate.
Be Honest About The Timeline: A Fortnight Is Not An Upgrade
Plenty of articles published this month end with “upgrade before 11 August”. For most stores that is not achievable, and pretending otherwise leads to the genuinely dangerous outcome, which is a rushed upgrade pushed straight to production.
A Magento major version upgrade is not a Composer command. Version 2.4.9 moved the supported stack substantially: PHP 8.5, Composer 2.10, MySQL 8.4 or MariaDB 12.3, OpenSearch 3, Valkey 9, RabbitMQ 4.3, Varnish 8 and nginx 1.30. Two of those changes catch teams out badly. Elasticsearch no longer appears in the supported matrix at all, and Redis has been replaced by Valkey. That is infrastructure work sitting underneath the application work.
On top of the platform itself, every third party extension needs a compatible release, every core customisation needs review, and PHP 8.5 will surface deprecations in older custom modules. Then the whole thing needs testing across checkout, payment, shipping, tax, search and any integration you run, on a staging environment that mirrors production.
What You Can Realistically Do Before The Date
Given that, here is what the next fortnight is genuinely good for.
Establish your exact position. Version, patch level and edition, written down. This takes minutes and determines everything else. It also tells you whether you are in the Adobe Commerce group with a further year of cover.
Apply every patch currently available to you. While 2.4.6 is still in support, patches are still being issued for it. Going into the cut-off fully patched is materially better than going in three patches behind, and it is achievable in the time available. This is routine security patch installation work rather than a project.
Get an upgrade scoped, not started. An audit of your extensions, custom modules and integrations tells you whether you are a six week upgrade or a fourteen week one. That number is what lets you plan properly instead of guessing. A Magento code audit is the usual starting point.
Tighten what you control. Admin hardening does not depend on your version: a non-default admin URL, two factor authentication on every account, access restricted by IP or VPN, and removal of accounts belonging to people who have left. Most compromises that begin at the admin panel begin with a credential that should have been deleted long ago.
Week one: confirm version and edition, apply all available patches, inventory every extension and custom module. Week two: get the upgrade scoped and quoted, agree a target version and a start date, and harden admin access. You will pass 11 August on an expiring version, but you will pass it fully patched, with a dated plan rather than an intention.
Choosing Your Target Version
If you are upgrading anyway, the next question is what to upgrade to. There are three defensible answers and the right one depends on your appetite for change.
2.4.9 is the current release and gives you the longest runway, into May 2029. It also demands the most: PHP 8.5, OpenSearch 3 and Valkey mean the infrastructure changes alongside the application. If you are going to do the disruption once, this is the version that buys the most time for it.
2.4.8 is supported to 31 May 2028 and is usually the pragmatic middle. The stack jump is smaller, extension compatibility is broader because the release has been out longer, and you still get a comfortable window before the next decision.
2.4.7 is supported to 31 May 2027. It is a short hop and buys under a year, so it mainly makes sense as a deliberate stepping stone when the gap from your current version is very large and you want to split the work into two smaller, safer moves.
The version most stores should not choose is the one that requires the least work today and the most work in eleven months. Our step by step upgrade walkthrough covers the mechanics, and Magento upgrade services exist for teams who would rather not absorb it internally. Where the store is old enough that upgrading and rebuilding cost something similar, migration is worth pricing as an alternative rather than assuming an in place upgrade is cheapest.
The Real Risk Was Never The Deadline
It is worth putting this date in proportion, because the industry’s actual failure mode is not dramatic expiry. It is ordinary delay.
Security firm Sansec found that roughly 75 percent of Magento and Adobe Commerce stores were still unpatched a week after the fix was published for the vulnerability known as CosmicSting, tracked as CVE-2024-34102. Thousands were subsequently breached. Every one of those stores was on a supported version with a patch available. Support status was not the problem. The gap between publication and application was.
The practical implication is that an upgrade is only half the job. A store on 2.4.9 with nobody responsible for applying patches ends up in the same position as a store on 2.4.6, just more slowly. Ongoing Magento support and maintenance is the part that keeps the benefit of the upgrade.
How This Plays Out By Industry
The deadline is uniform but the pressure is not, and it is worth being realistic about where the difficulty actually sits.
Retail and consumer brands carry the highest extension counts and the strongest seasonal constraints. For retail operations, an upgrade started now lands well before peak trading, whereas one started in September collides with change freezes. The calendar, not the deadline, is the binding constraint.
B2B operations have the most to check, because B2B stores typically run company accounts, shared catalogues, requisition lists and negotiated quotes, plus ERP integration. Several of those capabilities are Adobe Commerce features, which usually means the edition question is already answered, and with it a further year of extended support.
Fashion and apparel stores tend to carry heavy theme customisation and large variant catalogues, so the front end absorbs more of the upgrade effort than the back end. For fashion retailers, theme compatibility is usually the item that sets the timeline.
Logistics and industrial suppliers often have the least visible complexity and the most integration risk, since logistics operations connect to shipping, inventory and pricing systems that must be regression tested as carefully as checkout.
Common Mistakes
Rushing a production deploy to beat the date. A broken checkout costs more in a weekend than an expiring version costs in a month. Assuming the deadline applies to you equally. Adobe Commerce customers have until August 2027, and acting as though they do not wastes budget. Upgrading and stopping there. Without a patching routine the new version decays exactly like the old one. Treating it as purely a developer task. The stack changes mean hosting and infrastructure need to be in the conversation from day one.
Your Pre-Deadline Checklist
How We Can Help
If you want a straight read on where your store stands, that is a short piece of work rather than a project. We can confirm your version, edition and patch level, tell you what a realistic upgrade path and timeline look like for your specific extension footprint, and give you a number you can plan around. If the answer is that you have until 2027, we will tell you that too.
That work spans Magento upgrades, platform migration, security patching, performance audits and ongoing store support, and extends to Adobe Commerce where the licensed edition is the right fit. If you would rather add capacity to your own team than hand the work over, you can hire Magento developers directly.
Talk to us about your upgrade and we will start with your version and your extension list rather than a proposal. You can read more about how we work, look through our client work, or start from our homepage if you are new here.
Related Reading
- How to Choose a Magento Development Agency (2026 Buyer’s Guide)
- Magento: The Complete Guide to Building and Scaling a Store That Performs
- How to Update Magento 2 to the Latest Version
- What the Magento 2.4.9 Release Means for Your Store
- Why Magento 2 Works for B2B Businesses
- Performance Optimisation for Magento 2
- Magento 2 Development in Docker
- Magento for Industrial and Equipment Sellers
- Magento 2 Features Worth Using
Frequently Asked Questions
Answers to the questions we hear most often.
When exactly does Magento 2.4.6 support end?
Magento 2.4.6 reaches the end of its regular support on 11 August 2026. The version was released on 14 March 2023, giving it the standard three year support window Adobe applies across the 2.4 line. After that date, Adobe stops issuing security patches, bug fixes and technical support for the 2.4.6 code base unless you qualify for extended support, which is available to Adobe Commerce customers only. The date is published in Adobe's software lifecycle policy, so it is a fact you can verify yourself rather than something you need an agency to confirm.
What actually happens to my store on 12 August 2026?
Nothing visible. Your store keeps running, the admin panel still works, customers see no difference, and no warning appears anywhere. That is exactly what makes this risk easy to postpone. What changes is invisible: when a new vulnerability is found in Magento core code, no patch is produced for the 2.4.6 line. The vulnerability is still published and still exploited, but your store never receives the fix. Rather than something breaking on one day, exposure begins accumulating from that day and never stops growing.
Does the deadline apply to Adobe Commerce and Magento Open Source in the same way?
No, and this is the single most important distinction to establish. Adobe offers an extended support period beyond the standard window, which continues to deliver quality and security patches. For 2.4.6 that runs to 30 August 2027, followed by a limited security-only transitional period. However, extended support is available to Adobe Commerce customers only and is not available for the Magento Open Source code base. So a licensed Adobe Commerce store on 2.4.6 has roughly another year of cover, while a self-hosted Magento Open Source store on the same version has a hard stop on 11 August 2026.
I run Magento Open Source 2.4.6. What are my options?
Upgrading to a supported version is the only route that restores patch coverage, because extended support does not cover the Open Source code base. Your realistic targets are 2.4.7 (supported to 31 May 2027), 2.4.8 (to 31 May 2028) or 2.4.9 (to 31 May 2029). Since a safe upgrade usually takes 6 to 14 weeks, the practical plan for the remaining time is to apply every patch still available to you, inventory your extensions and custom modules, and get the upgrade scoped and scheduled rather than rushed into production.
Can I realistically upgrade before 11 August 2026?
For most stores, no, and attempting it creates a bigger risk than missing the date. A Magento major upgrade is not a single Composer command. It involves auditing extensions and custom code, rebuilding the server stack, migrating code and data, running a full test cycle across checkout, payment, shipping, tax, search and every integration, then a rehearsed deployment. That is typically a 6 to 14 week project. A broken checkout pushed live in a hurry costs more in one weekend than a few additional weeks on an expiring version. Aim to pass the date fully patched with a dated plan agreed.
Which version should I upgrade to?
Three answers are defensible. Version 2.4.9 gives the longest runway, into May 2029, but demands the most because the supported stack moved to PHP 8.5, OpenSearch 3 and Valkey. Version 2.4.8 is supported to 31 May 2028 and is usually the pragmatic middle, with a smaller stack jump and broader extension compatibility because the release has been available longer. Version 2.4.7 runs to 31 May 2027 and mainly makes sense as a deliberate stepping stone when the gap from your current version is very large. Avoid whichever option minimises work now and maximises it next year.
Is Magento 2.4.5 affected at the same time?
Yes, and it is easy to miss. Version 2.4.5 reached the end of its standard support in August 2025, and its extended support ends on 12 August 2026, one day after the 2.4.6 date. Version 2.4.4 passed the same milestone earlier, on 14 April 2026, so stores still running it are already receiving nothing. If your store has not been upgraded in a couple of years, you are statistically more likely to be on one of these older lines than on 2.4.6, which is why confirming your exact version is the first step rather than an afterthought.
How do I check which Magento version I am running?
From the command line, run bin/magento --version in your Magento root directory, which returns the exact version including the patch suffix such as 2.4.6-p15. You can also read it from the footer of the admin panel. Record the edition as well as the number, because whether you hold an Adobe Commerce licence or run Magento Open Source determines whether your real deadline is August 2026 or August 2027. If you do not have access, whoever hosts or maintains the store can answer in under a minute, and reluctance to answer quickly is itself worth noting.
What does upgrading to Magento 2.4.9 require from my server?
More than teams usually expect, because 2.4.9 moved the supported stack substantially. The matrix covers PHP 8.5, Composer 2.10, MySQL 8.4 or MariaDB 12.3, OpenSearch 3, Valkey 9, RabbitMQ 4.3, Varnish 8 and nginx 1.30. Two changes catch people out in particular: Elasticsearch no longer appears in the supported matrix at all, and Redis has been replaced by Valkey. That means infrastructure work sits underneath the application work, so hosting needs to be part of the conversation from day one rather than treated as a detail to resolve at deployment.
Does running an unsupported Magento version affect PCI compliance?
It can, and Adobe's own lifecycle documentation flags that running out-of-support software puts PCI compliance at risk. The general principle is that unsupported software cannot receive security fixes, which is difficult to reconcile with the expectation that systems handling card data are kept patched. This tends to surface at the worst moments, either during an assessment or during an investigation after an incident. If you take card payments, confirm your specific position with your acquiring bank or qualified security assessor rather than assuming, since requirements vary by how you process payments and your merchant level.
If patches were available, why do so many stores still get breached?
Because the risk has always been the delay rather than the disclosure. Security firm Sansec found that roughly 75 percent of Magento and Adobe Commerce stores were still unpatched a week after the fix was published for the vulnerability known as CosmicSting, tracked as CVE-2024-34102, and thousands were subsequently breached. Every one of those stores was on a supported version with a patch already available. This is why an upgrade alone is only half the job: a store on 2.4.9 with nobody responsible for applying patches ends up in the same position as one on 2.4.6, just more slowly.
What should I do if I cannot upgrade before the deadline?
Use the time for the things that are genuinely achievable. Confirm your exact version, patch level and edition in writing, since that alone may reveal you have until 2027. Apply every security patch currently available for your version, because going into the cut-off fully patched is materially better than going in several patches behind. Inventory your extensions and custom modules so the upgrade can be scoped into a real timeline. Then harden what does not depend on your version: a non-default admin URL, two factor authentication on every account, IP or VPN restrictions, and removal of accounts belonging to people who have left.






