Resolution
For Adobe Commerce on Cloud, Adobe Commerce on-premises, and Magento Open Source software
Note: This issue is resolved by the latest cloud-patches update. Attempting to apply the Isolated patch when the fix is already in place from the cloud-patches update can cause installation failures.
To help resolve the vulnerability for the affected products and versions, you must apply the Isolated patch, depending on your Adobe Commerce/Magento Open Source version.
Isolated Patch Details
Use the following attached Isolated patches, depending on your Adobe Commerce/Magento Open Source version:
Note: To apply an Isolated security patch file, merchants must be on the latest security-only patch release (the latest -p version) for their supported release line, as Isolated security fixes are tested exclusively against that version. See the Patch release schedule for more information.
Note: The ZIP file can include a separate patch file for each Adobe Commerce component (CE, EE, B2B, PageBuilder, etc.), and some components may have more than one file, each built for a different version of that component.
For each component installed in your environment, apply the one file whose version matches your installed version of that component. After applying, use the Commerce Version Tool (see below) to confirm your installation is fully patched.
Example: If you have Community Edition (CE) on version 2.4.6-p15, you would only need to apply:
- 246p15-2026-07-001-CE
If you have Enterprise Edition (EE) on 2.4.6-p15, you would apply:
- 246p15-2026-07-001-CE → 246p15-2026-07-001-EE
If you have B2B and are on CE/EE 2.4.6-p15, you would first apply the same two files:
- 246p15-2026-07-001-CE → 246p15-2026-07-001-EE
After that, depending on your installed B2B version, apply the matching B2B patch:
- If on B2B 1.5.2-p5 → apply 152p5-2026-07-001-B2B
- If on B2B 1.4.2-p10 → apply 142p10-2026-07-001-B2B
Download Isolated patches
Notes
- Open Source customers can only download patches for version 2.4.6 or later.
- Adobe Commerce customers on version 2.4.5 or earlier must enter their Composer keys to download older patches.
For version 2.4.9
For version 2.4.8-p5
Note: This isolated patch applies only to 2.4.8-p5. If you are on an earlier patch level in this line, first update to 2.4.8-p5, then apply this isolated patch.
For version 2.4.7-p10
Note: This isolated patch applies only to 2.4.7-p10. If you are on an earlier patch level in this line, first update to 2.4.7-p10, then apply this isolated patch.
For version 2.4.6-p15
Note: This isolated patch applies only to 2.4.6-p15. If you are on an earlier patch level in this line (for example, 2.4.6-p14 or older), first update to 2.4.6-p15, then apply this isolated patch.
For version 2.4.5-p17
Note: This isolated patch applies only to 2.4.5-p17. If you are on an earlier patch level in this line, first update to 2.4.5-p17, then apply this isolated patch.
Note: After clicking the patch file link below for 2.4.5-p17 in a browser, merchants will see a pop-up dialog box, where they should enter their Composer public key as the username, and their Private key as the password.
For version 2.4.4-p18
Note: This isolated patch applies only to 2.4.4-p18. If you are on an earlier patch level in this line, first update to 2.4.4-p18, then apply this isolated patch.
Note: After clicking the patch file link below for 2.4.4-p18 in a browser, merchants will see a pop-up dialog box, where they should enter their Composer public key as the username, and their Private key as the password.
How to apply the Isolated patch
Unzip the file and see How to apply a composer patch provided by Adobe in our support knowledge base for instructions.
For Adobe Commerce on Cloud merchants only - How to tell whether the Isolated patches have been applied
Considering that it isn’t possible to easily check if the issue was patched, you might want to check whether the Isolated patch has been successfully applied.
You can do this by taking the following steps, using the file VULN-27015-2.4.7_COMPOSER.patch as an example:
-
Run the command:
vendor/bin/magento-patches -n status |grep "27015\|Status" -
You should see output similar to this, where VULN-27015 returns the Applied status:
Note:
Adobe is introducing a new tool with these security updates:
Since a monthly security release can include several patch files, use the Commerce Version Tool below to confirm your installation is fully patched.
Commerce Version Tool: This tool is for both Adobe Commerce on-premises and Adobe Commerce on Cloud infrastructure environments. A standalone executable included with each monthly Adobe Commerce security patch. It helps merchants to verify patch coverage by reporting which monthly security patches are installed, which are missing, and which CVEs the installation is protected against. Note that the Commerce Version Tool is only available after a merchant applies the CE (Community Edition) patch file. Note that Adobe Commerce security patches are non-cumulative and must be applied in sequence. Additional information is available here.
Security updates
Security updates available for Adobe Commerce:
Why This Month’s Security Patches Are Not Available as Composer Packages
As outlined in the official Adobe Commerce release schedule (available on Experience League: Release Schedule), the security fixes released on July 14, 2026, for Adobe Commerce versions 2.4.9, 2.4.8, 2.4.6, 2.4.5, and 2.4.4 were classified as Isolated security fixes.
For this type of release, Adobe provides the fixes as Isolated patch files only, and Composer packages aren’t published alongside them. This is intentional: Isolated patches are designed to give merchants a fast, lightweight way to apply critical security fixes without needing to go through a full Composer-based update cycle, which can take longer and may involve additional dependency resolution.
For merchants on Adobe Commerce on Cloud infrastructure:
These security patches can also be applied directly through Magento Cloud Patches.
You can find the relevant details here: Cloud Patches – Release Notes. This gives Cloud merchants a streamlined path to stay current without manually managing the Isolated patch file.
Was this content helpful?
Announcements
Get hands-on with agentic AI.
Explore how AI agents work together through real examples and hands-on practice. Join your local User Group to design an agent workflow with your peers and leave with a practical framework you can apply to your own work.
Find an event