Magento end of life: every version's support dates, and what to do past them

Magento end of life is set per release line, not platform-wide. As of October 23, 2026, Adobe gives 2.4.7 to 2.4.9 standard support. On Adobe Commerce, 2.4.6 has extended support to August 2027; 2.4.4 and 2.4.5 get security-only fixes to May 31, 2027. Magento Open Source gets regular patches only on 2.4.7 and later. Magento 1 ended in June 2020.

The line Adobe never writes down is the Open Source one: its lifecycle policy doesn't mention Magento Open Source at all. The bulletins do. APSB26-92, on August 11, 2026, was the last monthly bulletin to list an Open Source 2.4.6 fix, while Adobe Commerce 2.4.6 gets fixes until May 31, 2028. And since July 14, 2026, those monthly fixes ship as patch files that bin/magento --version never reports, so a patched store and an unpatched one print the same version.

This guide is for merchants and developers on Magento 2, either edition, self-hosted or on Adobe's cloud. You'll get every line's dates in one table, the PHP, database and search deadlines that land first, the commands that show your real patch level, and a decision tree. Adobe's own pages disagree on three of these dates. We use the lifecycle policy's and footnote the others.

Magento end of life, version by version#

Adobe's lifecycle policy sets the Magento 2 end of life dates for 2.4.4 to 2.4.9, and its released-versions page covers 2.4.10 and the older lines. The PHP, database and search columns come from Adobe's on-premises system requirements for each line's newest patch, shown in brackets.

Magento 2.4 end of life dates, as of October 23, 2026

1. 2.4.6 extended support. Adobe's lifecycle policy and released-versions page give August 31, 2027 for the end of 2.4.6 extended support; Adobe's enforcement page, the 2.4.6 security-patch release notes and the system-requirements page say August 30, 2027. We use the lifecycle policy's date.
2. Adobe Commerce only. The extended and security-only columns apply to Adobe Commerce only. Magento Open Source gets neither.
3. Cloud. Cloud enforcement applies to Adobe Commerce on Cloud only: upgrades are due by June 1, 2027 for 2.4.4 and 2.4.5 and by June 1, 2028 for 2.4.6 and 2.4.7. Cloud's stack tables have no MySQL or Elasticsearch rows.
4. Monthly patches. The bracketed patch is each line's last Composer release; from 2.4.4 to 2.4.9, all shipped on May 12, 2026. Monthly isolated patch levels (for example 2.4.6-2026-oct) aren't shown by bin/magento --version.
5. Stack. Adobe "supports only the system requirement combinations listed", and earlier patches differ (2.4.7-p9 still listed MySQL 8.0). For 2.4.3 and older, the stack comes from Adobe's 2.4.0 release notes and composer.json at each GitHub tag.
6. 2.4.7 and 2.4.8 standard support. Adobe's 2.4.8 release notes still say "until April 2027" for 2.4.7 and "until April 2028" for 2.4.8; we use the lifecycle policy's May 31 dates.

One trap: the support clock isn't always the release date plus three years. 2.4.6 went GA on March 14, 2023, and its standard support ended on August 11, 2026, about five months past that anniversary. 2.4.7 to 2.4.9 all end on May 31, whatever their release day: 2.4.8 was released on April 8, 2025, and its standard support ends May 31, 2028.

The three support tiers: standard, extended and security-only#

The Adobe Commerce lifecycle policy, last updated September 18, 2026, defines three tiers, each shipping less than the one before.

Standard support#

Adobe's definition: "The standard three-year support period from the General Availability (GA) date. Standard support includes quality fixes, security patches, and full Adobe Commerce on-call support." For zero-days, Adobe ships hotfixes "for all customers on a supported version, even if they are not on the latest patch".

Extended support for 2.4.6 and 2.4.7#

"Adobe offers one year of additional support at no additional cost for Adobe Commerce customers on versions 2.4.6 and 2.4.7. The support extension includes quality and security patches for the core application." So it isn't a paid add-on for Commerce, and Open Source can't buy it at any price. Adobe's release policy: "Extended support security patches are available to Adobe Commerce customers only. They are not available for the Magento Open Source code base."

Magento security-only support for 2.4.4 to 2.4.6#

The third tier is "a one-time, time-limited transitional period available only for versions 2.4.4, 2.4.5, and 2.4.6". It "provides limited isolated security fixes only (no quality fixes)", and it has three limits:

• It ends on schedule. "It will not be extended beyond the published dates. Treat the security-only period as migration time, not as a long-term support tier."
• It skips PHP. For 2.4.4 and 2.4.5 it excludes "compatibility support for application dependencies (for example, PHP), or platform dependency updates" (Adobe), and both lines list only PHP 8.1, end of life since December 31, 2025. Every store in this tier runs an end-of-life PHP.
• It's Commerce-only. "These provisions are available to Adobe Commerce customers only. They do not extend support for third-party dependencies such as MySQL" (Adobe).

Magento Open Source versus Adobe Commerce: who still gets patches#

Adobe's policy pages say only that the extended and security-only tiers are Commerce-only. The monthly bulletins show what Open Source gets, and as of October 23, 2026 they draw this line:

APSB26-73 (July 14, 2026) and APSB26-92 (August 11) list Open Source 2.4.6 fixed versions; APSB26-138 (September 8) and APSB26-153 (October 13) don't, and October's still lists Open Source 2.4.6 as affected. Adobe's October patch note: "Open Source merchants can only download patches for version 2.4.7 or later." So scanners flag Open Source 2.4.6 for October's CVEs, with nothing to apply. For Open Source 2.4.4 and 2.4.5, the last public GitHub tags are 2.4.4-p13 and 2.4.5-p14, the last releases from their standard support.

Zero-day hotfixes are the exception: Adobe's hotfix for CVE-2026-75650 (APSB26-146, September 7, 2026, CVSS 10.0, priority 1, "exploited in the wild") covers every line from 2.4.4 to 2.4.9 on both editions, and in September 2025 the APSB25-88 hotfix reached Open Source 2.4.5 after its standard support had ended.

Community-run Mage-OS doesn't cover the older lines either. It patches "the latest release branch only"; 3.6.0 is "built on the same Magento Open Source 2.4.9 base as 3.5.0", and its migration script takes stores on "Magento 2.4.8+".

Your stack expires too: PHP, MySQL, Elasticsearch and OpenSearch#

Adobe's dates cover Magento's code, not what it runs on: Adobe "does not provide security and quality fixes for third-party services and software dependencies (such as PHP and MySQL)" that reach end of life during support. Below is each vendor's date as of October 23, 2026, from php.net and its end-of-life page, Oracle, MariaDB, Elastic and OpenSearch, against the lines Adobe's Magento system requirements list it for (on-premises, newest patch):

PHP: the deadline that lands first#

PHP runs out before Adobe does on every line from 2.4.4 to 2.4.7. 2.4.6's newest PHP, 8.2, loses security support on December 31, 2026, while Adobe's window for Commerce 2.4.6 runs to May 31, 2028: about 17 months on an end-of-life PHP. On 2.4.7, PHP 8.3 ends five months before extended support does. Adobe marks PHP 8.1 and 8.2 "PCI compliance at risk" (Adobe), and our October 2026 PHP security release post shows what an end-of-life branch gets when a critical bug lands.

Composer's answer isn't Adobe's, either. 2.4.9's composer.json accepts PHP 8.3, which Adobe calls "no longer supported" from 2.4.9, and PHP 8.4 "is allowed for upgrade purposes only (not recommended for production)" (Adobe). Composer itself has a clock too: Adobe's floor for 2.4.4 to 2.4.6 is Composer 2.2.26+, and the 2.2 LTS line gets "Critical security fixes only" until at least December 31, 2026 (Composer).

MySQL 8.0 and MariaDB#

Adobe: "MySQL 8.0 reached End of Support (EOS) on April 30, 2026", and 2.4.4 to 2.4.7 "do not provide compatibility or support for MySQL versions released after MySQL 8.0" (Adobe). That leaves those lines with no supported MySQL, and Adobe "strongly recommends migrating your database servers to a compatible MariaDB version." On 2.4.4 that means MariaDB 10.6, whose community support ended on July 6, 2026.

Elasticsearch 7.17 and OpenSearch#

"Elasticsearch 7.17 reached End of Support (EOS) on January 15, 2026", and Adobe "strongly recommends migrating your search infrastructure to a compatible OpenSearch version" (Adobe). Elasticsearch 8 gets mixed signals: 2.4.8's release notes say Adobe Commerce "is no longer compatible with Elasticsearch", yet the requirements table lists Elasticsearch 8 for 2.4.7-p10 and 2.4.8-p5. Plan on OpenSearch.

What happens the day support ends#

The store keeps running#

Adobe's End of Support FAQ answers the panic question: "No, Adobe Commerce software does not 'shut down' once the end of support date is reached or passed." The license stays valid while your account is in good standing. The fixes stop.

No more fixes from Adobe#

Adobe "will no longer create further product changes for that version", functional, quality, security and PCI compliance changes included. Support tickets submitted afterwards "will not be resolved", and the version's online documentation comes down: the 2.3.7 release notes already return a 404 on Experience League.

Extensions and the Marketplace#

Adobe runs "monthly automated checks" for Marketplace listings that support only end-of-life lines, and the developer gets "a 30-day window to submit a compatible version; otherwise the listing is removed from the Marketplace" (Adobe). Count your extensions before your date, ERP, PIM and marketplace connectors included: they're extensions too, and usually the hardest to replace.

PCI and your assessor#

The lifecycle policy: "PCI compliance is the merchant's responsibility to assess. Adobe strongly recommends that merchants on affected versions consult with their qualified security assessor". The End of Support FAQ: "Once a version of Adobe Commerce software is no longer supported, that version is no longer PCI compliant."

The PCI SSC's FAQ 1597 says requirement 6.3.3 patches "for critical vulnerabilities must be resolved within one month of release", and PCI DSS v4.0.1 is the standard's only active version. Our reading: once your line gets no Adobe fix for a critical CVE, Adobe gives you nothing to install inside that month. Whether a compensating fix satisfies 6.3.3 is your assessor's call. If your store is already hacked or down, skip the planning and start with triage.

Adobe Commerce on Cloud: suspension#

Environments that miss Adobe's Cloud deadlines "may have Admin access suspended, while the storefront remains online, and/or have inbound traffic suspended, taking the storefront offline." Stay non-compliant after a traffic suspension and Adobe "may terminate the cloud services", after which the data "will be permanently deleted and cannot be restored" (Adobe).

Adobe Commerce on Cloud: the deadlines that come first#

Adobe's enforcement page, last updated October 14, 2026, covers "Adobe Commerce on Cloud (PaaS) environments running Adobe Commerce versions 2.4.4 through 2.4.9", not Adobe Commerce as a Cloud Service or on-premises stores, and the transitional provisions "do not replace Cloud upgrade enforcement" (Adobe). As of October 23, 2026:

Three things the table doesn't say:

• The October 30 ticket window closed on September 30. Adobe asks you to "open your ticket at least 30 days before your enforcement date". If you're late, Adobe's advice is to "contact your account team or Adobe Support as soon as possible" for a short extension.
• On 2.4.4 and 2.4.5, Adobe gives one dependency date. Its Table 1 reads "Required by October 30, 2026." for those lines, where 2.4.6 and later get "October 30, 2026, or May 31, 2027, depending on the software". Only Table 2's OpenSearch 1.x row names them for May 31, 2027.
• On Cloud, Adobe's "fully supported" list is short. "Fully supported versions include 2.4.8, 2.4.9, or the latest available release."

Patch in place, upgrade in place, or replatform: a decision tree#

Edition, line, stack, custom code and roadmap decide it. Start at the top and stop at the first branch that fits.

1. Do you run 2.4.7, 2.4.8 or 2.4.9, on either edition?
   • If yes, stay current: the line's newest -p release, every monthly patch in release order, and the CVE-2026-75650 hotfix, which October's file lacks. On 2.4.7, plan the next line before May 31, 2027 with our Magento upgrade service.
   • If no, go to question 2.
2. Do you run Adobe Commerce 2.4.4, 2.4.5 or 2.4.6?
   • If yes, Adobe still ships fixes to the matrix dates, but none for PHP: 2.4.4 and 2.4.5 run an end-of-life PHP 8.1, and 2.4.6's PHP 8.2 ends December 31, 2026. Upgrade in place inside that window, and price it with what a Magento upgrade or rebuild typically costs.
   • If you run Magento Open Source 2.4.6 or older, or any line from 2.4.3 down, go to question 3.
3. Can the store reach 2.4.8 or later, extensions and custom modules included?
   • If yes, upgrade in place to the target line's newest patch.
   • If yes, but not before the next critical CVE lands, patch in place as a bridge, then upgrade. Backports we publish go on our free Magento security patches page as they ship. For a patch today, talk shop with us.
   • If no, because the extensions, custom code or roadmap no longer fit Magento, replatform, starting with the ecommerce replatforming checklist.

Patch in place, and its limits#

Adobe allows it: its End of Support FAQ says you "can look for security firms, developers, or partners who will provide support for unsupported versions of Adobe Commerce", and leaves vetting them, re-certifying compliance and resolving "on-going security threats" to you. That's the Magento security hardening work we do: we backport the security fixes Adobe no longer ships for your line and test them on a copy of your store. It lowers the risk. It doesn't remove it. A backport fixes Magento's code, not an end-of-life PHP, MySQL 8.0 or Elasticsearch 7.17, and Adobe itself says "a hotfix is not comprehensive".

Upgrade in place#

Upgrade to the target line's newest patch, not its GA. Composer ranks 2.4.7 above 2.4.6-p15, but 2.4.7 GA shipped on April 9, 2024 and 2.4.6-p15 on May 12, 2026, so a jump to a GA can land you on older security code than you left. Adobe "recommends installing or upgrading Adobe Commerce to the latest security patch available for each release" (Adobe). And 2.4.8 is a bigger step than its number suggests: its "PHP 8.4 compatibility required breaking changes", and you "must upgrade to PHP 8.3 before upgrading to Adobe Commerce 2.4.8" (Adobe).

Replatform#

Replatform when the upgrade costs about as much as a rebuild: extensions with no release for 2.4.8 or later, custom modules nobody wants to port, or a roadmap Magento no longer fits. Price both sides over the same years. Moving off Magento to another platform covers the method, and Magento to Shopify migration covers that route.

How to check your Magento version and patch level#

Run these from the Magento root as the web-server user. We ran the bench commands below read-only on clean Magento Open Source 2.4.6 and 2.4.9 benches on October 23, 2026, and the outputs are the 2.4.6 bench's. The Commerce Version Tool and Quality Patches Tool commands are Adobe's documented usage, not run: neither bench has either tool.

bin/magento --version

Magento CLI 2.4.6

The admin footer prints the same value (Magento ver. 2.4.6 on our bench). Adobe: "The current version displays in the bottom-right corner of any Admin page." Composer shows the metapackage behind both:

# Magento Open Source
composer show magento/product-community-edition
# Adobe Commerce
composer show magento/product-enterprise-edition

name     : magento/product-community-edition
descrip. : eCommerce Platform for Growth (Community Edition)
keywords :
versions : * 2.4.6
type     : metapackage

The versions : * line is the installed release. Security patch releases are "appended with '-pN'" (Adobe), so on 2.4.6-p15 expect * 2.4.6-p15; our benches run GA builds.

That still isn't the whole patch level. Since July 14, 2026, Adobe ships its monthly fixes as "Isolated patch files only, and Composer packages aren't published alongside them" (Adobe). On-premises stores apply them with patch -p1 < %patch_name%.patch (Adobe), which doesn't touch composer.lock, the file bin/magento --version reads. So a fully patched 2.4.6-p15 and an unpatched one print the same line, and bulletin levels such as 2.4.6-2026-oct appear in no built-in command.

Adobe's tool for that level, the Commerce Version Tool, reads composer.lock, then dry-runs the patches against your code:

php vendor/bin/patch-status --version
php vendor/bin/patch-status
php vendor/bin/patch-status --format=csv

Adobe documents the report's fields as base_version, installed_components, applied_patches, missing_patches, unknown_patches, vulnerability_status (PROTECTED, VULNERABLE, UNKNOWN or NOT_APPLICABLE), registry_source and warnings (Adobe). The tool "requires PHP 8.1 or later and the system patch binary", is "informational only", and "can write cache files, temporary dry-run files, and audit-log entries". The catch: "CVT is only available in the July 2026 Security Isolated patch file", and Open Source 2.4.5 and older could never download a 2026 monthly file.

Two rules decide what it finds. Each monthly patch needs your line's latest -p release and every earlier monthly patch for the line, applied "in release order". And the CVE-2026-75650 hotfix isn't in the October patch file: it "must be applied separately", and its remediation also requires rotating the encryption key and the credentials it protected (Adobe).

The Quality Patches Tool is a different tool, and a plain Open Source install doesn't have it: composer show magento/quality-patches answered Package "magento/quality-patches" not found…. Adobe's docs install it with composer require magento/quality-patches and read its status with ./vendor/bin/magento-patches status (Adobe). It reports quality patches and hotfixes, and Adobe uses it to check an isolated security patch only on Cloud.

Then the stack:

php -v
composer --version
bin/magento config:show catalog/search/engine
curl -s http://<search-host>:9200

SELECT VERSION();

On the 2.4.6 bench, php -v began PHP 8.1.34 (cli), the engine setting read opensearch, the search host's JSON carried "distribution" : "opensearch" and "number" : "2.5.0", and SELECT VERSION(); returned 8.0.46. Against the matrix, that's a PHP past end of life, a MySQL that 2.4.6's newest patch no longer supports, and an OpenSearch older than the 2.19 it lists.

The admin won't flag any of this: none of the core System Messages reports the version or patch level, and the default Notifications feed's newest item, read on October 23, 2026, is dated June 13, 2023.

Magento 1: ended June 2020, and still out there#

Adobe's bulletin APSB20-41, published June 22, 2020, closed the line: "Support for Magento Commerce 1.14 and Magento Open Source 1 is ending in June 2020. This will be the final security patches available for these editions." Its fix, SUPEE-11346, covered Magento Commerce 1.14.4.5 and earlier and Magento Open Source 1.9.4.5 and earlier.

Magento 1 end of life support now comes only from third parties, or from leaving:

• OpenMage LTS, a community project, says it "allows Magento 1.x EOL merchants to continue running a secure, stable Magento-based platform while remaining PCI compliant" (OpenMage). Its v20.18.0, published May 4, 2026, sets PHP >=8.1 <8.6 in composer.json (GitHub).
• Leaving it. A move to Magento 2 is a migration, not an upgrade, and we scope it like any replatform, with every old URL mapped. The same holds for a Magento to Shopify migration.

Magento end of life FAQ

Sources