Adobe Commerce 2.4.6 end of support is 8 days away: Most merchants aren't ready for what happens next

Adobe Commerce 2.4.5 and 2.4.6 reach end of support on August 11, 2026. Your storefront won't stop functioning, but the risks compound over time: security vulnerabilities, compliance gaps, and ecosystem decay. The recommended action is upgrading to 2.4.8 or 2.4.9. Magento Open Source merchants have no extended support option.

On August 11, 2026, Adobe ends regular support for Adobe Commerce 2.4.5 and 2.4.6. For an estimated 112,000+ stores running on these versions, the countdown has entered single digits.

Most coverage of this deadline focuses on the obvious implication: no more security patches. That's true and important; Adobe adopted a monthly patch release schedule starting in January 2026, meaning supported versions now receive more frequent security fixes than ever. Merchants on 2.4.5 and 2.4.6 will be excluded from that cadence entirely after August 11.

But the patching gap is actually the most visible and most manageable part of the problem. The real risk is quieter, more gradual, and harder to detect: the entire ecosystem around an unsupported version starts to decay, and your storefront continues to look perfectly functional while the infrastructure beneath it becomes progressively more fragile.

The ecosystem decay nobody talks about

End of support is not a switch that flips on August 11. It's a process that accelerates from that date forward, and it affects every layer of your commerce stack:

1. Extension vendors stop testing. The marketplace extensions your store depends on, payment gateways, shipping integrations, ERP connectors, and marketing tools are maintained by vendors who allocate testing resources to supported versions. Within weeks of an EOL date, most vendors shift their QA matrix forward. Your extensions don't stop working immediately, but the next update to any of them may not be tested against your version. And when something breaks, the vendor's first response will be: "upgrade to a supported version."

2. Payment integration compatibility drifts. Payment processors regularly update their SDKs, API endpoints, and security requirements. Stripe, Adyen, PayPal Braintree each maintain compatibility matrices that reference supported platform versions. An unsupported Adobe Commerce version may continue processing payments today, but when a processor deprecates an older API version or requires a new authentication method, the integration path for your version disappears.

3. PCI compliance becomes a moving target. Running on an end-of-life platform version doesn't automatically make you non-compliant, but it makes demonstrating compliance significantly harder. Your QSA or ISA will ask how you're patching known vulnerabilities on a version that no longer receives patches. "We have a WAF" is an answer, not a strategy, and it becomes harder to defend with each month that passes.

4. Search and performance expectations evolve. Google's Core Web Vitals thresholds, structured data requirements, and crawl behaviour expectations continue to advance. Platform-level improvements in newer versions address these requirements. An older version locks you into whatever performance ceiling its architecture supports.

The Magento Open Source gap

There's a critical distinction many merchants have missed: Adobe Commerce licensed customers may be eligible for extended support through August 30, 2027, depending on their contract terms. Magento Open Source merchants have no equivalent path.

If you are running Magento Open Source 2.4.6, August 11 is a much harder deadline. There is no extended support option. There is no transitional security-only period. Community patches may emerge, but they come without warranties, without guaranteed coverage, and without the testing infrastructure of an official release.

Before making any decisions about your upgrade path, verify three facts with whoever maintains your environment: the exact version and patch level you're running, whether you hold an Adobe Commerce license or run Open Source, and whether your contract includes any extended support entitlement.

The skimmer threat is already here

This isn't a theoretical security discussion. In March 2026, Sansec reported a WebRTC-based payment skimmer that exploited the PolyShell vulnerability in Magento and Adobe Commerce, affecting an estimated 56.7% of scanned stores. The skimmer uses WebRTC DataChannels instead of standard HTTP requests to exfiltrate stolen payment data, bypassing Content Security Policy (CSP) controls that many merchants rely on as a defensive layer.

Stores running unsupported versions are not just exposed to future vulnerabilities; they are exposed to existing, actively exploited attack vectors that may already be present on their storefronts and going undetected.

The challenge is that compromised stores typically show no visible symptoms to the merchant. The checkout page looks normal. Payments process normally. The skimmer operates in the gap between the customer's browser and the merchant's server, stealing card data during legitimate transactions. Only the customer's bank statement reveals the problem, weeks later, and it is never traced back to your store by the customers themselves.

The four realistic options

Not every store running 2.4.6 needs to panic, but every store needs a plan:

Option 1: Upgrade to 2.4.8 or later. The cleanest path forward. Apply the latest security patches, gain performance improvements, and return to a supported release line. Budget four to twelve weeks for a well-planned upgrade, depending on your customisation complexity.

Option 2: Patch to the latest 2.4.6 release and hold. Apply every available patch, harden your infrastructure and WAF layer, and accept a defined window of elevated risk while you plan properly. If you're weeks from peak season or midway through another migration, this may be the pragmatic choice, temporary by design, not a permanent strategy.

Option 3: Replatform. If your Adobe Commerce investment no longer makes strategic sense, the EOL deadline is a natural decision point. But replatforming is a six-to-twelve-month project for most mid-market stores. Don't pretend August 11 is the starting gun for that race.

Option 4: Extend (Adobe Commerce only). If your licence includes extended support eligibility, exercise it immediately and use the additional time to plan a proper upgrade. This is buying time, not solving the problem.

What to monitor through the transition

Regardless of which path you choose, the days and weeks around August 11 require heightened attention to your storefront's behaviour:

1. Checkout completion rates. A sudden drop in conversion that isn't explained by traffic changes may indicate a payment integration issue or a front-end error introduced by an extension update that wasn't tested against your version.
2. JavaScript errors on checkout and payment pages. These are the first symptoms of skimmer injection and the first indicators of extension incompatibilities after an ecosystem starts to age out.
3. Payment gateway response patterns. Monitor for increases in declined transactions, timeout errors, or authentication failures that may signal a payment provider updating their integration requirements.
4. Third-party resource loading. Track whether all external scripts, stylesheets, and API calls on your storefront continue to load successfully. CDN changes, analytics updates, and marketing tag modifications by vendors can break silently on older platform versions.
5. Structured data integrity. As your extensions age out of testing compatibility, structured data output can degrade: invalid schema, missing product attributes, incorrect pricing, without any visible change to your product pages.

The monitoring gap is the real risk

The most dangerous aspect of running an end-of-life platform isn't that something will break. It's that something will break and you won't know.

Your store will continue to render product pages, accept orders, and process payments right through August 11 and beyond. The surface-level experience won't change. What changes is the probability of silent failures: a skimmer your CSP doesn't catch, a payment integration that starts dropping 2% of transactions, an extension that returns incorrect shipping rates after its next update.

These are the documented patterns of post-EOL ecosystem decay across every major commerce platform. They happen slowly enough to miss, and fast enough to matter.

AuditIQ eCommerce monitoring provides the continuous storefront monitoring that catches these failures as they happen, from the customer's perspective, in real time. Whether you're upgrading, holding, or replatforming, knowing what's actually happening on your live storefront is the difference between a managed transition and a crisis you discover from your customers.

Try AuditIQ for free and see what's actually happening on your storefront before August 11.

FAQs

1. What exactly happens to my Adobe Commerce 2.4.6 store after August 11, 2026? Adobe stops releasing security patches and quality fixes for your version. Your store continues to function, but you'll no longer receive fixes for newly discovered vulnerabilities, and extension vendors will gradually stop testing compatibility with your version.

2. Is there a difference between Adobe Commerce and Magento Open Source for this deadline? Yes. Adobe Commerce licensed customers may be eligible for extended support through August 30, 2027, depending on their contract. Magento Open Source merchants have no equivalent; August 11 is a hard deadline with no transitional path.

3. How do I know if my store has already been compromised before I upgrade? Standard server logs and uptime tools often won't show signs of compromise. Look for unexpected scripts loading on checkout pages, unusual network requests to unfamiliar domains, or subtle changes in payment form behaviour. Continuous storefront monitoring from the customer's perspective is the most reliable way to detect these symptoms early.