Adobe Commerce 2.4.9 & Security Patches : What Is New & What Is Fixed

Hundreds of bug fixes, multiple actively-exploited vulnerabilities now patched, and the biggest platform infrastructure shift in years , here is a plain-English guide to what changed, what is at stake, and what to do next.

Two Updates, Two Levels of Urgency

Adobe Commerce has dropped two significant update tracks within a short window, and they serve different purposes. Understanding the difference helps you prioritise the right action for your store.

Adobe Commerce 2.4.9 is a substantial feature and platform release. It delivers over 560 bug fixes, replaces three ageing core libraries, improves checkout flows, and modernises the admin experience. As of writing it remains in beta , not yet intended for live stores , but planning for it now avoids a scramble when the GA release lands.

The 2.4.8 Security Patches (p1 through p5) are a different matter entirely. These are emergency-grade security releases targeting vulnerabilities that attackers have already been exploiting in the wild. If your store runs any unpatched version of 2.4.8, it is currently exposed. There is no waiting here.

A useful way to frame it: the security patches protect what you have built. The 2.4.9 upgrade strengthens where you are headed. Both matter , but the timeline on each is very different.

What the 2.4.8 Security Patches Actually Fixed

Adobe issued five patch increments across the 2.4.8 release line, each addressing a distinct cluster of vulnerabilities. Below is a plain-English summary of what each one covers, who it affects, and why it is serious.

It is also worth noting that the p1 patch fixed a side-effect of the earlier APSB25-08 security update , applying that patch had unintentionally slowed down bulk asynchronous API operations. Stores relying on bulk product imports, order processing pipelines, or integrations that use async endpoints would have seen degraded performance until p1 was installed.

What is New in Adobe Commerce 2.4.9

With 560 confirmed fixes across Adobe Commerce and a further 501 in Magento Open Source, version 2.4.9 is not a minor patch cycle , it is a genuine platform step forward. Here are the changes with the most direct impact on store operations.

Admin Usability , Two-Factor Authentication Simplified

Previously, if a store had multiple 2FA methods enabled , such as Google Authenticator alongside a hardware security key , every single admin user had to set up every enabled method before they could log in. For team members who did not own a hardware key, this was an outright blocker.

In 2.4.9, each admin user only needs to configure one of the enabled providers to access the panel. Additional methods can be added at their own pace. The security posture is unchanged; the friction for legitimate users is dramatically reduced.

Staging Preview , What You See Is What Shoppers See

The mobile preview inside the admin staging tool previously rendered inaccurate results , layouts that appeared correct would display differently on actual phones. Store owners were approving campaign and promotion changes that turned out to be broken on the devices most shoppers use.

2.4.9 fixes this with browser-simulated mobile rendering in the staging preview. What you approve in the admin is now a faithful representation of the mobile experience.

Express Checkout , Promo Codes Now Work Everywhere

Both Apple Pay and Google Pay express checkout sheets now support promotional and offer codes. This gap had a direct revenue impact: customers who chose the fastest checkout path were unable to apply the same discounts available through standard checkout. That inconsistency is resolved in 2.4.9, meaning express checkout customers now receive the same incentives as everyone else.

PayPal Express , Shipping Reliability Improved

The shipping cost callback during PayPal Express checkout has been moved from the customer's browser to the server. The old approach relied on the browser to report back shipping data, which made the calculation vulnerable to network issues and browser inconsistencies. Server-side processing makes this step more reliable and harder to manipulate.

B2B Quote Checkout , Silent Order Failure Fixed

Merchants running Adobe Commerce B2B will recognise this one. When checking out from a negotiable quote using Payflow Pro, clicking Place Order would cause the page to spin indefinitely , no error message, no confirmation, no order. The sale was lost silently. This is fixed in 2.4.9.

Catalogue Management , Bulk Actions on Price Rules

The Catalog Price Rules grid in the admin now includes the same bulk actions that Cart Price Rules have offered for some time , activate, deactivate, and delete multiple rules at once. For stores managing large promotional rule sets, this removes a significant manual workload.

Security Hardening , Libraries and API Gatekeeping

Three JavaScript libraries fundamental to the Adobe Commerce interface have been upgraded: jQuery UI to 1.14.1, jQuery Validate to 1.21.0, and the Uppy file upload library to 4.13.4. Each upgrade closes known security vulnerabilities in file handling and form validation while also improving compatibility with current browsers.

Separately, CAPTCHA protection has been extended to REST and GraphQL API endpoints. Previously, a bot could bypass the CAPTCHA on your customer registration form simply by calling the API directly, sidestepping the browser form entirely. That bypass is no longer possible in 2.4.9.

Read More : Magento 2.4.9 Is Coming : Everything Magento Store Owners Need to Know Before May 2026

Patched vs Unpatched: The Business Cost

The following table translates the technical vulnerabilities into business-level consequences. The left column shows what is at risk on an unpatched store; the right column shows the outcome after correct patch application.

How VDCstore Manages This Process for You

Patch deployment on Adobe Commerce is not a one-click operation. Every update requires compatibility checks against your current Magento Extensions and theme, a structured staging deployment, database backups with documented rollback steps, and for B2B merchants, a specific sequencing of the core patch followed by the B2B module update. Skipping or misordering any of these steps can bring a store down.

At VDCstore, we run patch deployments as structured engineering operations. Here is the process we follow every time:

1. 1. Environment audit , We map your current version, third-party extensions, and theme against the target patch to surface compatibility conflicts before any work begins on production.
2. 2. Staging deployment , The patch is applied to an exact replica of your live store. Full regression testing covers checkout flows, payment methods, admin functions, and all API integrations.
3. 3. Backup and rollback preparation , A verified database and filesystem backup is created before any production changes. A tested rollback procedure is documented and ready to execute within minutes if needed.
4. 4. Production deployment , The update goes live during your minimum-traffic window. For B2B merchants, the B2B extension patch is applied in the correct order immediately after the core patch.
5. 5. Verification and sign-off , We run a complete smoke test across checkout, payments, admin access, email templates, and API endpoints. You receive a written confirmation of patch status and any follow-up items to watch.

Specific Tasks We Handle for These Updates

• Applying the CVE-2025-54236 emergency hotfix (VULN-32437) and confirming the custom attributes module is at version 0.4.0 or above
• Correct B2B Magento 2 Extension sequencing , the B2B security patch must follow the core patch, not precede it
• Admin 2FA audit and user communication following the updated login flow in 2.4.9
• Bulk API performance verification after the APSB25-08 regression fix in 2.4.8-p1
• Extension and theme compatibility assessment against the 2.4.9 changelog ahead of GA release
• REST API constructor review for custom modules , required by the changes introduced with CVE-2025-54236
• Encryption key rotation via CLI, as the Admin UI method has been removed in recent patch versions

Closing Thoughts

The volume of security activity around Adobe Commerce in 2025 reflects how high-value the platform has become as a target. These are not theoretical vulnerabilities discovered by academic researchers , CVE-2025-54236 was already being used against live stores when Adobe disclosed it. The time between publication and active exploitation is shrinking.

The good news is that every vulnerability in the 2.4.8 patch series has a clear, tested fix available. The 2.4.9 upgrade path, while still in beta, gives merchants a well-signposted route to a significantly more stable and capable platform. Neither track requires guesswork , they require discipline and a structured approach to deployment.

VDCstore exists to take that operational burden off store owners and their teams. You should be focused on growing your business, not managing patch sequences and rollback procedures. That is what we are here for.