Magento Version Update Required - APSB25-94 Security Update

[Meetanshi]

Adobe has released a critical security update APSB25-94 on October 14, 2025, addressing multiple high-severity vulnerabilities that could allow:

• Security feature bypass (Improper Access Control)

• Privilege escalation (Cross-Site Scripting)

• Arbitrary code execution (Incorrect Authorization)

Actions Required:

1. Update to the latest patched version immediately.

2. Always back up your store before applying patches.

3. Test the update on a staging environment first.

4. Apply selective patches if a full upgrade isn’t possible.

Affected Versions

• Adobe Commerce ≤ 2.4.9-alpha2

• Commerce B2B ≤ 1.5.3-alpha2

• Magento Open Source ≤ 2.4.9-alpha2

Patched Versions

• 2.4.9-alpha3

• 2.4.8-p3

• 2.4.7-p8

These updates are strongly recommended to prevent potential risks such as unauthorized admin access, customer data exposure, or downtime.

For a deeper look, see the official Adobe release guide or our detailed post on the Meetanshi blog.

Don’t have time to apply the patch/upgrade Magento version yourself? No worries, our experts can handle it for you. Check out our Magento Security Patch Installation Service.

[amir_prince]

To complete your post with all the relevant versions and their corresponding patches.

Affected and Patched Versions:

Adobe Commerce:
2.4.9-alpha2 and earlier → 2.4.9-alpha3
2.4.8-p2 and earlier → 2.4.8-p3
2.4.7-p7 and earlier → 2.4.7-p8
2.4.6-p12 and earlier → 2.4.6-p13
2.4.5-p14 and earlier → 2.4.5-p15
2.4.4-p15 and earlier → 2.4.4-p16

Adobe Commerce B2B:
1.5.3-alpha2 and earlier → 1.5.3-alpha3
1.5.2-p2 and earlier → 1.5.2-p3
1.4.2-p7 and earlier → 1.4.2-p8
1.3.5-p12 and earlier → 1.3.5-p13
1.3.4-p14 and earlier → 1.3.4-p13
1.3.3-p15 and earlier → 1.3.3-p16

Magento Open Source:
2.4.9-alpha2 and earlier → 2.4.9-alpha3
2.4.8-p2 and earlier → 2.4.8-p3
2.4.7-p7 and earlier → 2.4.7-p8
2.4.6-p12 and earlier → 2.4.6-p13
2.4.5-p14 and earlier → 2.4.5-p15

[richardcol2f55]

Thanks for the update! This patch looks critical — especially for stores still on 2.4.8 or below. Quick reminder to test on staging before pushing live to avoid module conflicts.

[roshankaushish]

Please let me know from where i can download the security patch APSB25-94

[linkjuice121dd]

That’s a useful discussion — upgrading versions can be tricky, but following proper migration steps really helps avoid unexpected issues.

[amir_prince]

The installation depends on your Magento version, let's take the version 2.4.6-p13

So to patch the 2.4.6-p13

For open source edition:

composer require magento/product-community-edition=2.4.6-p13

For the Commerce edition :

composer require magento/product-enterprise-edition=2.4.6-p13 

For more informations, you have the official adobe releases notes in https://experienceleague.adobe.com/en/docs/commerce-operations/release/notes/security-patches/2-4-6-...

I also wrote an article on Magento Stack Exchange with more details about what a patch is, the different types, how to install them, etc. If you're interested, you can take a look at it in https://magento.stackexchange.com/a/377277/48355