Adobe Commerce 2.4.5-p17

Apply the PHP 8.1.34 baseline first. These rules cover Adobe Commerce 2.4.5-p17 on Cloud infrastructure or on-premises. Use Commerce's account, session, encryption, and service APIs for Commerce-managed data. This release line is tested on PHP 8.1 only; Commerce's transitional security coverage does not extend upstream PHP support. Standard support ended on 12 August 2025, extended support ended on 11 August 2026, and limited security-only coverage ends on 31 May 2027. That coverage is for Adobe Commerce customers, not Magento Open Source 2.4.5.

Release scope and required remediation

• Keep the Composer base on the newest 2.4.5 security patch release (-pN) that Adobe's released-versions page lists, and install the isolated security fixes published for it; the package version alone does not establish current protection.
• On 2.4.5-p17, apply the July APSB26-73, August APSB26-92, and September APSB26-138 monthly patches in that order. Each month depends on earlier months rather than replacing them. Within each month, apply CE, then EE, then the matching B2B file when present; apply other installed-component files according to the archive instructions.
• Match every patch to the installed component version, including B2B and Page Builder. Upgrade B2B to the security release compatible with p17 before selecting its isolated fixes; do not apply every alternative file in an archive.
• Apply the separate APSB26-146 hotfix for CVE-2026-75650 immediately. For p17, Adobe supplies VULN-39341-composer-patches.zip. The September monthly patch does not contain this actively