Adobe Commerce 2.4.6-p15

Last reviewed Oct 28, 2026

Export as PDF

Prompt Details

Prompt Composition

2prompts
  1. PHP 8.2118 lines · 5.8K tokens
  2. Adobe Commerce 2.4.6-p1599 lines · 4.3K tokens
Total217 lines · 10.2K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 78
  • 79
  • 88
  • 89
  • 95
  • 98
  • 113
  • 117
  • 187
  • 201
  • 203
  • 208
  • 209
  • 214
  • 250
  • 256
  • 294
  • 295
  • 306
  • 307
  • 308
  • 312
  • 319
  • 323
  • 327
  • 328
  • 338
  • 340
  • 347
  • 352
  • 354
  • 359
  • 362
  • 367
  • 377
  • 384
  • 390
  • 409
  • 425
  • 434
  • 470
  • 494
  • 502
  • 522
  • 524
  • 532
  • 552
  • 601
  • 611
  • 613
  • 614
  • 627
  • 639
  • 640
  • 674
  • 732
  • 759
  • 760
  • 770
  • 776
  • 778
  • 798
  • 807
  • 829
  • 862
  • 863
  • 915
  • 916
  • 918
  • 940
  • 942
  • 1004
  • 1021
  • 1275
  • 1287
  • 1333
  • 1336
  • 1395

Prompt Preview

Apply the PHP 8.2 baseline first, then these rules for the exact Adobe Commerce 2.4.6-p15 Composer release on-premises or on Cloud infrastructure. Adobe tests this patch with PHP 8.2 and 8.1; use PHP 8.2 because PHP 8.1 has ended upstream security support. Commerce support does not extend PHP 8.2 security maintenance beyond 31 December 2026.

Release scope and security remediation

  • For installations using isolated patches over this package, verify the complete monthly chain against Adobe's current Trust Center bulletins; the Composer package alone does not supply those later fixes.
  • Apply monthly files in release order because they are non-cumulative. Within each month, apply CE, then EE, then matching B2B files when present; apply other installed-component files, including Page Builder, according to the archive instructions and their exact component versions.
  • Verify the separate emergency remediation for CVE-2026-75650, which is actively exploited and is not replaced by the September monthly update; do not postpone this remediation while preparing other upgrades.
  • Complete APSB26-146 remediation by rotating the encryption key and potentially exposed credentials at their sources: Admin passwords, integration tokens and OAuth secrets, payment, shipping and tax API keys, database and Fastly credentials, and SSH, deployment and service-account credentials. Re-encryption alone does not revoke stolen credentials.
  • On Cloud, update cloud-patches to obtain the monthly fixes and inspect applied status before adding equivalent isolated files. Confirm the separate