Required actions and deadlines to secure Commerce environments
The cybersecurity landscape is fundamentally changing, and the defensive mechanisms enterprises have in place need to rapidly evolve. Security is critical for ecommerce businesses because online transactions require them to handle sensitive personal and business data, exposing them to financial and identity risks in the event of a breach. PaaS ecommerce environments have a shared responsibility model where the customer is responsible for security and maintenance of application layer dependencies, integrations with third-party software, and deployment pipelines.
At Adobe, we remain committed to addressing the evolving risks and ensuring that we setup our Adobe Commerce on Cloud customers to the highest security standards. This includes:
-
Monthly isolated security fixes for faster and predictable protection against critical vulnerabilities
-
Cloud Patches for Commerce Package to ensure delivery of Adobe patches and hot fixes that improve integration with Cloud environments and allow quick resolution of critical issues
-
Lifecycle enforcement policies
-
Out of cycle hotfixes, if necessary
-
Annual patch releases with long term support
While Adobe takes the necessary steps to help keep our customers secure, the shared responsibility model for Adobe Commerce on Cloud requires that our customers always be on a supported version of Adobe Commerce on Cloud and third-party software, apply application patches, audit third-party extensions, and secure custom code. Software that has passed end of vendor support no longer receives security patches, leaving security issues in the software unaddressed. Continuing to run your ecommerce storefront on unsupported software creates a real and growing security risk.
This page outlines the actions all customers on Adobe Commerce on Cloud (version 2.4.4 to 2.4.9) need to take to ensure their ecommerce environment remains secure, along with the enforcement dates and what to expect when the security requirements are not met.
Actions required to maintain a secure and compliant environment
To keep your ecommerce environment secure and mitigate risks, all customers on Adobe Commerce on Cloud (version 2.4.4 to 2.4.9) are required to use:
-
Supported versions of all 3rd party software dependencies (PHP, MariaDB, Elasticsearch, OpenSearch, Redis, RabbitMQ)
-
A secure and supported version of Adobe Commerce on Cloud. Fully supported versions include 2.4.8, 2.4.9, or the latest available release. See the Lifecycle policy documentation.
Follow the guidelines below to check if you need to take action to secure your Adobe Commerce on Cloud environment. Environments that do not meet the security requirements by the deadlines outlined in Table 1 below will have inbound traffic suspended, taking the storefront offline. If you have concerns about meeting the deadline, please contact your account team or Adobe Support as soon as possible.
Table 1: Security requirements and deadlines
Detailed steps to secure your environment
Engage your Commerce Admin to go through the following steps.
Action 1: Verify and upgrade third-party software dependencies
Check that your environment is running vendor-supported versions of the following third-party software dependencies: PHP, MariaDB, Elasticsearch, OpenSearch, Redis, RabbitMQ. If not, upgrade the software dependency to a supported version.
Step 1: Check your third-party software dependency versions
- Sign in to the Cloud Console where you can see all of your Cloud projects.
- Open the relevant project, then select the environment you want to review.
- Open “Containers” tab, where you can see a list of all the services currently in use on the selected environment.
- Click each service link to check the exact version currently running in the environment.
See the instructions in Configure Services for more details.
All unsupported software dependencies must be upgraded to the versions outlined by the timelines shared in Table 2 below.
Table 2: Required dependency upgrades
Step 2: Prepare for a third-party software dependency upgrade
Adobe will help you upgrade these software dependencies directly.
-
Get started: Open a support ticket listing the environments you need upgraded and the dependencies involved. Open your ticket at least 30 days before your enforcement date so Adobe can schedule the work.
-
Downtime: Adobe will confirm the expected window with you when scheduling.
-
Testing: Upgrade and validate a non-production environment before production. At minimum, validate checkout, search, cart, and any custom integrations. Requirements apply to all your environments, so plan to upgrade every environment rather than production alone.
-
Compatibility: Most of these changes are version upgrades within the same software and carry low risk. The following changes warrant closer attention:
- Elasticsearch to OpenSearch and Redis to Valkey are migrations to different software rather than version upgrades. Custom code, extensions, or configuration referencing the original service may need an update.
- Upgrading from PHP 8.1 to 8.2 can surface deprecations in custom code and third-party extensions.
If you use third-party extensions, confirm with your vendors that their current releases support your target versions. If you work with a solution integrator, involve them in planning and validation.
Action 2: Check your Adobe Commerce on Cloud version and upgrade to a supported version
Step 1: Check your Adobe Commerce on Cloud version and required action
-
Log in to your Adobe Commerce Admin panel.
The current version displays in the bottom-right corner of any Admin page.
-
If the version is hidden from the Admin panel, use the Adobe Commerce Command-line tool to see the version by running the following command:
code language-shell bin/magento --version
Check the required actions for your Adobe Commerce version in the table below.
Table 3: Adobe Commerce on Cloud version upgrade requirements
Reason: Versions 2.4.4 and 2.4.5 will receive only limited, isolated security fixes for the core application until May 31, 2027. This does not include quality fixes, compatibility support for application dependencies (for example, PHP), or platform dependency updates. See Adobe’s Lifecycle Policy.
Reason: Version 2.4.6 will receive extended support through August 30, 2027, and will receive only limited, isolated security fixes for the core application until May 31, 2028. Version 2.4.7 will receive standard support through May 31, 2027, and extended support through May 31, 2028. See Adobe’s Lifecycle Policy.
Reason: No deadline has been set.
Step 2: Determine the upgrade or migration path
If you need to upgrade your Adobe Commerce on Cloud version, then you have two options:
- Upgrade to a supported Adobe Commerce on Cloud version
- Migrate to Adobe Commerce as a Cloud Service (SaaS)
The following table helps you compare your options and determine the best path for you.
Table 4: Adobe Commerce on Cloud compared to Adobe Commerce as a Cloud Service
What happens if no action is taken by the deadline?
Adobe remains committed to supporting you in executing the steps you need to take to adopt a supported version of 3rd party software, upgrade to the latest version of Adobe Commerce on Cloud or migrate to Adobe Commerce as a Cloud Service. If you have concerns about meeting the deadline and need a short extension, please contact your account team or Adobe Support as soon as possible.
If an environment has not met the security requirements by the enforcement dates shared above, Adobe will be forced to take appropriate action to maintain security of the Adobe Commerce platform and its customers. This includes suspending traffic to the affected infrastructure, and as a result your Commerce storefront will go offline.
If an environment continues to remain non-compliant following traffic suspension, Adobe may terminate the cloud services, initiating the decommissioning process. As a result of decommissioning, all data and assets within the hosted commerce environment, including all instances, environments, and branches, will be permanently deleted and cannot be restored.
Resources to support you with upgrades or migration
If you choose to upgrade to Adobe Commerce on Cloud version 2.4.9:
-
Upgrade Compatibility Report: Adobe provides a detailed report identifying exactly what your upgrade to Adobe Commerce version 2.4.9 requires, including identifying what modules and files require updates, number of critical issues, and so on. See the Site-Wide Analysis Tool documentation for details on how to generate your upgrade compatibility report.
-
Software dependency upgrade: Since you cannot upgrade software dependencies directly, open a support ticket for Adobe to handle the upgrade for you. For details, see Configure Services.
If you choose to migrate to Adobe Commerce as a Cloud Service:
Adobe provides tools that reduce the cost and time of migrating to Adobe Commerce as a Cloud Service. They are available at no cost to you. These tools apply to migration only. They are not used for Adobe Commerce on Cloud version upgrades. See the migration overview for the full migration guide, including migration paths and phases.
-
Migration assessment: Rates the migration complexity of your customizations. See the Migration Assessment Tool overview.
-
Data migration: The bulk and incremental data migration tool moves your data to your new Adobe Commerce as a Cloud Service environment. For access, contact Adobe Support.
-
AI-assisted migration and developer tools: Adobe Developer App Builder and Commerce Storefront powered by Edge Delivery Services help accelerate storefront modernization and extension re-platforming.
If you have questions, please get in touch with your account team or contact Support Services.