Adobe Commerce Security Enforcement Is Coming: What Your Store Needs to Fix Before October 30

The New Era of AI Comes with Risk: A Risk Management Checklist to Keep Your Store Safe, Compliant, and Trusted

In February 2024, security researchers at JFrog reported about 100 malicious AI models on Hugging Face that could run code on the machine of anyone who loaded them. A few months later, Hugging Face disclosed unauthorized access to secrets on its Spaces platform.

If a major AI platform can be targeted, a store that runs AI chatbots, AI plugins, and third party integrations deserves the same level of care.

That care now has a date attached. Adobe enforces its security requirements for Adobe Commerce on Cloud on October 30, 2026. This guide covers what the date requires, what to fix first, and how to use the weeks you have left. It also covers the AI era risks that apply to every Adobe Commerce and Magento store, wherever it is hosted.

Who the October 30 date covers

Adobe’s enforcement policy applies to Adobe Commerce on Cloud environments running versions 2.4.4 through 2.4.9. Adobe states that the guidance does not apply to Adobe Commerce as a Cloud Service or to on premises deployments.

If your store runs on AWS with us, on your own servers, or with another host, Adobe’s date will not switch off your storefront. The security risks in the rest of this guide still apply to you, and the same habits protect you.

What Adobe requires

Adobe requires supported versions of the third party software your store depends on. Two dates matter.

Version upgrades follow their own dates. Stores on 2.4.4 or 2.4.5 upgrade by June 1, 2027. Stores on 2.4.6 or 2.4.7 upgrade by June 1, 2028. Stores on 2.4.8 or 2.4.9 need no version action, and the dependency dates above still apply to them.

Two of these changes deserve extra attention. Moving from Elasticsearch to OpenSearch and from Redis to Valkey means changing to different software, so custom code, extensions, and configuration that mention the old service may need updates. Moving from PHP 8.1 to 8.2 can bring out deprecations in custom code and third party extensions. One more point on PHP: Adobe lists PHP 8.2 itself as reaching end of life on December 31, 2026, with PCI compliance at risk after that date, so plan for PHP 8.3 or 8.4 where your Commerce version supports it.

How the upgrade work is done

On Adobe Commerce on Cloud, you cannot upgrade these services yourself. Adobe performs the dependency upgrade after you open a support ticket, and asks for that ticket at least 30 days before the enforcement date. Adobe applies the requirements to every environment, so list staging and integration environments along with production.

Your half of the work is testing. Adobe asks merchants to upgrade and validate a non production environment first and, at minimum, check checkout, search, cart, and custom integrations. For the October 30 date, the 30 day mark was September 30. If your ticket is not open yet, open it today and ask Adobe about scheduling.

What happens if you do nothing

Adobe suspends inbound traffic to any environment that misses the requirements, and the storefront goes offline. If an environment stays out of compliance, Adobe may end the cloud service, and the data and assets in that environment are permanently deleted.

For a B2B store, that means stopped orders, buyers who cannot reach their account or their price list, and a hard conversation with finance and compliance teams. Merchants who need a short extension can contact their Adobe account team or Adobe Support, and earlier is better.

Why patch speed matters more in the AI era

Delayed patching has a track record on this platform. After CosmicSting (CVE-2024-34102) was published in June 2024, Sansec counted 4,275 stores hacked by seven separate groups, about 5% of all Adobe Commerce and Magento stores, and reported that roughly 75% of stores had not patched when automated scanning began.

SessionReaper (CVE-2025-54236) followed in 2025. Adobe released the fix on September 9, 2025. Six weeks later, Sansec reported that only 38% of stores had patched, and mass attacks began within days of a public technical writeup.

The pattern continues. On September 7, 2026, Adobe released APSB26-146 for CVE-2026-75650, a critical template engine flaw with a CVSS score of 10.0 that lets an unauthenticated attacker run code on an affected store. Adobe reports it is being exploited in the wild. Adobe’s hotfix guide asks merchants to apply the hotfix and rotate credentials. A day later Adobe released its regular September update, APSB26-138, and asks merchants to apply the APSB26-146 hotfix in addition to it.

Automated tools already turn a published flaw into mass attacks within days. In our view, AI tools lower the effort of building and running those tools further, which shrinks the safe window between a patch release and an attack. Our advice to clients is simple: apply the fix the week it ships, and rotate credentials whenever the bulletin says so.

Four AI risks to check in your store

The OWASP Top 10 for LLM Applications lists prompt injection as its first risk and excessive agency, meaning an AI tool with more permissions than it needs, among the others. In a store, that translates into four checks.

• Prompt injection in store chatbots. A chatbot that can read customer or order data can be tricked into sharing it. Limit what the chatbot can see and test it with hostile prompts.
• Exposed API keys. AI tools often need keys. Keys pasted into code, chat tools, or plugin settings can leak. Store them in a secrets manager and rotate them on a schedule.
• AI generated phishing aimed at admin users. Convincing messages are now cheap to produce. Enforce two factor authentication for every admin and train your team to verify requests.
• AI agents with order or payment access. An agent that can change orders or move money needs tight limits, approval steps, and a full log of what it did.

Risk rating: Critical, High, Medium

Your timeline to October 30

AI readiness and risk checklist

• Every Adobe security bulletin from the last 12 months is applied on every environment.
• Cloud dependencies match Adobe’s table for your version.
• Every extension has a vendor confirmed release for your target versions.
• Admin accounts use two factor authentication.
• API keys sit in a secrets manager and rotate on a schedule.
• Store chatbots see only the data they need.
• AI agents have spending and action limits, approval steps, and logs.
• Someone owns patching, and that person can act within days.
• You can restore the store from a tested backup.
• Your team knows who to call when something looks wrong.

How Wagento helps

We build it, connect it, run it, and grow it. For this deadline that means reading your environment, finding what needs to change, testing the upgrade path, and carrying the work to production. For stores that want patching and monitoring off their plate for good, myMagento gives you managed hosting on AWS with 24/7 support and a named owner for every patch. If you need a one time upgrade, our Magento upgrade service scopes it as a project.

Planning the version upgrade too? Read Magento 2.4.6 Is No Longer in Regular Support: What Should You Do Now, and for the bigger picture on what sits under your store, The Invisible Dependencies That Can Take Your Store Offline.

Book a pre deadline security and upgrade assessment

Booking link: Book a time with Wagento