September 2026 has given Magento and Adobe Commerce merchants a good reason to review more than just their next security patch.

On September 7, Adobe released APSB26-146, an urgent security update addressing CVE-2026-75650, a critical vulnerability affecting Adobe Commerce and Magento Open Source. Adobe says the vulnerability can allow an unauthenticated attacker to execute arbitrary code and, more importantly, confirms that it has been exploited in the wild.

A day later, Adobe released its scheduled September security update, APSB26-138, covering additional critical, important and moderate vulnerabilities across supported Commerce and Magento Open Source versions.

For merchants already planning a Magento upgrade, this raises an obvious question:

Should you simply apply the September 2026 Magento security patches, or is this the right time to upgrade to Magento 2.4.9?

For many stores, the answer is actually both.

Patch the immediate security risk first. Then use the work as an opportunity to decide whether continuing to maintain an older Magento release still makes sense.

What happened in the September 2026 Magento security updates?

There are two separate September security events that Magento teams need to understand.

APSB26-146: an actively exploited critical vulnerability

Adobe published APSB26-146 on September 7, 2026.

The bulletin addresses CVE-2026-75650, which Adobe classifies as a critical vulnerability capable of resulting in arbitrary code execution. Adobe has also confirmed that the vulnerability is being actively exploited against Adobe Commerce merchants.

Affected versions include August 2026 security levels and earlier across:

• Adobe Commerce 2.4.4 through 2.4.9
• Magento Open Source 2.4.6 through 2.4.9
• affected Adobe Commerce B2B versions

That means being on Magento 2.4.9 does not automatically mean your store is protected.

Adobe provides a separate hotfix for CVE-2026-75650 and recommends applying it as soon as possible. Adobe also instructs affected merchants to rotate encryption keys as part of the remediation process.

APSB26-138: the regular September security release

On September 8, Adobe followed with APSB26-138.

This update addresses a separate group of critical, important and moderate vulnerabilities affecting Adobe Commerce and Magento Open Source. Issues include stored cross-site scripting vulnerabilities and authorization problems that could result in privilege escalation or security feature bypass.

At the time of Adobe’s bulletin, the company said it was not aware of active exploitation of the vulnerabilities covered by APSB26-138.

There is an important operational detail, however:

The September isolated security patch does not include the CVE-2026-75650 hotfix.

Adobe specifically states that merchants applying the September isolated security patch must also apply the APSB26-146 hotfix. The two fixes can be installed in either order.

So this is not a case where installing one September patch automatically resolves everything.

Should you patch Magento now or upgrade to 2.4.9?

If your production store is affected by CVE-2026-75650, the first priority should be straightforward:

Do not delay an urgent security fix while planning a larger Magento upgrade.

Apply the appropriate hotfix and September security updates first.

An upgrade project can involve extension compatibility checks, database changes, PHP upgrades, search infrastructure, queue services, custom modules, checkout integrations and regression testing. Even a well-maintained Magento installation should not leave a known critical vulnerability exposed while that work is being completed.

But once the immediate issue is under control, the question becomes more interesting.

If you are running an older Magento release, especially Magento 2.4.6 or earlier, September 2026 may be the point where repeatedly patching the existing stack becomes less attractive than moving to a newer platform baseline.

Magento 2.4.6 has reached the end of regular support

This is particularly relevant for stores still running Magento or Adobe Commerce 2.4.6.

Adobe ended regular support for the 2.4.6 release line on August 11, 2026. Extended support runs until August 31, 2027, followed by a limited security-fix period through May 31, 2028.

That does not mean a 2.4.6 store stops working on August 12.

It does mean that the platform has entered a different phase of its lifecycle.

Adobe describes the later security-only period as a transitional window providing limited isolated security fixes rather than quality fixes. In other words, it should be treated as time to migrate rather than as a permanent operating strategy.

For a merchant already spending development time testing September security patches on 2.4.6, it is therefore reasonable to ask whether that effort should become part of a Magento 2.4.9 upgrade plan.

Why Magento 2.4.9 is more than a security upgrade

Magento 2.4.9 was released on May 12, 2026, and Adobe currently provides regular support for the release line through May 31, 2029.

Moving to 2.4.9 therefore resets much more than the Magento application version.

It also creates an opportunity to modernize the underlying infrastructure.

Current Adobe Commerce 2.4.9 system requirements include technologies such as:

• PHP 8.5
• OpenSearch 3
• Valkey 9
• newer MariaDB versions
• newer message-queue infrastructure
• current Composer releases

Adobe’s 2.4.9 release notes specifically highlight PHP 8.5 compatibility, OpenSearch 3 support, Valkey 9 support and newer database support.

This matters because Magento technical debt rarely exists only inside Magento itself.

A store that has remained on an older Magento release may also be carrying older PHP versions, search infrastructure, Redis deployments, database versions, third-party extensions and deployment tooling.

That is why a Magento 2.4.9 upgrade should often be considered an infrastructure modernization project rather than simply a Composer version change.

When patching the existing Magento version still makes sense

Not every store needs an immediate major-version upgrade.

If you are already running Magento 2.4.8 or 2.4.9, your current release still has significant standard-support life remaining.

Adobe lists regular support through:

• May 31, 2028 for Magento/Adobe Commerce 2.4.8
• May 31, 2029 for Magento/Adobe Commerce 2.4.9

In that situation, applying the September security updates now and scheduling the broader upgrade separately may be perfectly reasonable.

Likewise, a heavily customized store approaching a major trading period may not want to combine an urgent security deployment with a large infrastructure migration.

Security remediation and modernization do not have to happen in the same deployment.

The mistake would be using that reasoning to postpone the security remediation itself.

When upgrading to Magento 2.4.9 becomes the better investment

The case for upgrading is much stronger when several of these conditions apply:

• you are still running Magento 2.4.6 or an older release
• PHP or other platform dependencies are approaching or already past their supported lifecycle
• extension updates have become increasingly difficult
• deployment requires accumulating isolated security patches
• Magento performance has deteriorated as customizations have grown
• the storefront still depends heavily on legacy Luma customizations
• Core Web Vitals or frontend performance are becoming business issues
• you are already planning infrastructure changes such as OpenSearch or cache migrations
• your team is repeatedly investing engineering time in keeping an aging platform combination alive

At that point, another patch can solve today’s vulnerability without solving the underlying maintenance problem.

That is where the September security event becomes useful as a planning trigger.

Patch the backend — but review the storefront too

A Magento modernization project does not necessarily have to stop at Magento 2.4.9.

For many established stores, backend upgrades are only one part of the problem. The storefront may still be responsible for slow rendering, poor Core Web Vitals, difficult frontend development or highly coupled Magento theme customizations.

An upgrade cycle is therefore a good moment to evaluate the frontend architecture as well.

Three broad approaches are common:

Keep the existing Magento storefront

If the current frontend performs well and the business does not need major UX changes, the lowest-risk option may be to upgrade Magento while retaining the storefront architecture.

There is no value in introducing architectural complexity purely because a newer option exists.

Move from Luma to Hyvä

For merchants that want to remain relatively close to Magento’s traditional architecture while substantially simplifying and modernizing the frontend, Hyvä can be attractive.

This can be especially relevant when the primary goals are Magento frontend performance, Core Web Vitals improvements and reducing the complexity associated with older Luma implementations.

Move to a headless Magento storefront

Stores needing greater frontend independence may instead consider a Magento headless commerce architecture.

Frameworks such as GraphCommerce use Magento’s GraphQL APIs while providing a React and Next.js-based storefront separately from Magento itself.

This approach can make sense where the business needs a highly customized customer experience, faster frontend iteration, modern React development or stronger separation between commerce services and presentation.

But headless should be a deliberate architecture decision—not something added automatically to a Magento upgrade.

Magento GraphQL should be part of the upgrade audit

For stores already using Magento as a headless backend, upgrading to 2.4.9 also means testing the API layer carefully.

A proper Magento GraphQL upgrade audit should cover more than whether queries compile.

Check areas such as:

• product and category queries
• customer authentication
• cart creation and cart merging
• checkout mutations
• payment integrations
• shipping methods
• custom GraphQL resolvers
• third-party Magento modules exposing GraphQL functionality
• caching behaviour
• GraphQL error handling
• frontend compatibility with schema changes

For a Next.js or GraphCommerce storefront, backend Magento upgrades and frontend regression testing should be treated as one deployment concern even though the two applications are technically separate.

A practical September 2026 Magento upgrade strategy

For most affected merchants, the safest order of operations is:

1. Address the current security exposure.

Apply the appropriate APSB26-146 hotfix for CVE-2026-75650 and the relevant September security update.

Follow Adobe’s remediation guidance, including encryption-key and associated credential rotation where applicable.

2. Confirm your exact Magento and dependency versions.

Audit Magento, PHP, OpenSearch or Elasticsearch, Redis or Valkey, MariaDB/MySQL, RabbitMQ, Composer and major third-party extensions.

3. Check your support timeline.

A store on 2.4.9 is in a very different position from a store on 2.4.6.

4. Audit extensions and custom modules before committing to the upgrade timeline.

The difficulty of most Magento upgrades is rarely the Magento core package itself. Custom code and third-party integrations are where much of the testing work occurs.

5. Build a Magento 2.4.9 staging environment.

Upgrade the application and compatible service dependencies outside production.

Adobe’s own upgrade guidance specifically calls out reviewing compatible MariaDB/MySQL, OpenSearch, RabbitMQ and Redis/Valkey versions as part of Commerce upgrades.

6. Run functional and performance regression tests.

Pay particular attention to catalog, search, customer accounts, checkout, payments, shipping, cron jobs, queues, APIs and third-party integrations.

For headless stores, test the GraphQL storefront separately.

7. Decide whether frontend modernization belongs in the same roadmap.

A Magento backend upgrade does not require a Hyvä or headless migration.

But if the business already has significant storefront technical debt, performing both projects as part of one modernization roadmap can avoid investing heavily in architecture you expect to replace soon afterward.

What should Magento 2.4.6 merchants do?

If your store is on Magento 2.4.6, September 2026 should probably trigger two separate actions.

Immediately: secure the current installation.

Next: begin planning the move away from 2.4.6.

Regular support has already ended, and Adobe’s lifecycle documentation makes it clear that later limited security coverage is intended as a transition period.

Moving to Magento 2.4.9 gives the business a significantly longer support runway while creating an opportunity to bring PHP, search, caching, database and message-queue infrastructure onto modern supported versions.

What should Magento 2.4.8 merchants do?

There is less urgency to perform a major upgrade purely for lifecycle reasons.

Magento 2.4.8 remains under regular support through May 2028.

Apply the relevant September security fixes now, then evaluate 2.4.9 according to your normal release roadmap, extension compatibility and infrastructure strategy.

If you were already planning changes such as PHP, OpenSearch or storefront modernization, however, moving directly to 2.4.9 may reduce duplicated work.

What should Magento 2.4.9 merchants do?

Do not assume that being on the latest Magento release automatically protects you from the September vulnerabilities.

Adobe lists 2.4.9 August 2026 security levels and earlier among the affected versions for the critical CVE-2026-75650 issue.

You still need to apply the appropriate September security remediation.

The advantage is that you do not need a platform-version upgrade simply to move onto a currently supported release line.

Patch now, modernize deliberately

Security incidents have a way of exposing technical debt that has been easy to postpone.

The September 2026 Magento security updates are a good example.

The immediate response should not be complicated: if your store is affected, patch it now.

But once the urgent work is complete, merchants on aging Magento versions should ask a broader question:

How much engineering effort are we spending maintaining the current platform compared with moving to a modern, supported baseline?

For some stores, the right answer will be to remain on the current supported Magento release and continue applying security updates.

For others—particularly Magento 2.4.6 stores—the better investment may be moving to Magento 2.4.9, upgrading the supporting infrastructure and using the same roadmap to address long-standing storefront or performance problems.

A security patch protects the store from today’s vulnerability.

A well-planned Magento modernization can reduce the cost and risk of the next one.

---

Frequently asked questions

Is Magento 2.4.9 affected by the September 2026 security issue?

Yes. Adobe lists Magento Open Source and Adobe Commerce 2.4.9 at the August 2026 security level and earlier among the versions affected by CVE-2026-75650. Merchants should apply Adobe’s applicable hotfix and September security updates.

Is CVE-2026-75650 being actively exploited?

Yes. Adobe states that it is aware of CVE-2026-75650 being exploited in the wild against Adobe Commerce merchants.

Does the September 2026 Magento security patch include the CVE-2026-75650 fix?

No. Adobe states that the APSB26-146 hotfix is separate from the September isolated security patch and must also be applied.

Has Magento 2.4.6 reached end of support?

Magento 2.4.6 reached the end of regular support on August 11, 2026. Adobe lists extended support through August 31, 2027 and additional limited security fixes through May 31, 2028.

How long is Magento 2.4.9 supported?

Adobe lists regular support for the 2.4.9 release line through May 31, 2029.

Should I upgrade Magento 2.4.6 directly to 2.4.9?

For many merchants, 2.4.9 is now the logical target because it provides the longest current support runway. The actual upgrade path depends on your extensions, custom Magento modules, PHP version, database, search infrastructure, cache, message queue and deployment environment.

Can a Magento 2.4.9 upgrade improve performance?

An application-version upgrade alone does not guarantee faster storefront performance. However, moving to 2.4.9 can be part of a broader Magento performance and infrastructure modernization involving newer PHP, OpenSearch, caching, database infrastructure and potentially a modern storefront such as Hyvä or a headless Magento frontend.

Should we switch to Hyvä or GraphCommerce while upgrading Magento?

Not automatically.

Hyvä can be a strong option when you want to modernize Magento’s frontend while remaining relatively close to the Magento ecosystem. GraphCommerce or another headless Magento architecture can make sense when frontend independence, React/Next.js development and highly customized customer experiences are strategic requirements.

The backend upgrade and frontend architecture decision should be evaluated together, but they do not have to be delivered at the same time.