Adobe Commerce on Cloud Security Deadlines: Everything You Need to Do Before Your Store Goes Offline
The cybersecurity landscape is evolving faster than ever. Attackers continuously discover new vulnerabilities, while businesses are expected to secure customer data, payment information, and mission-critical ecommerce systems. To strengthen platform security these policies require merchants to upgrade unsupported software dependencies and stay on supported Adobe Commerce versions. Unlike previous recommendations, these are mandatory security requirements. Stores that fail to comply by the specified deadlines may eventually have their inbound traffic suspended, making storefronts inaccessible until compliance is restored. If you’re running Adobe Commerce on Cloud, here’s everything you need to know.
Why Adobe is Enforcing These Changes?
Security isn’t just Adobe’s responsibility.
Adobe Commerce on Cloud follows a Shared Responsibility Model, where Adobe manages the infrastructure while merchants remain responsible for securing Application dependencies, Custom modules, Third-party extensions Deployment pipelines ,Application-level security patches.
Running outdated software creates security gaps because vendors stop releasing patches after products reach End of Support (EOS). That means unsupported versions of PHP, MariaDB, Redis, RabbitMQ, Elasticsearch, or even Adobe Commerce itself become attractive targets for attackers.
Who Does This Affect?
These requirements apply to,
- Adobe Commerce on Cloud 2.4.4
- Adobe Commerce on Cloud 2.4.5
- Adobe Commerce on Cloud 2.4.6
- Adobe Commerce on Cloud 2.4.7
- Adobe Commerce on Cloud 2.4.8
- Adobe Commerce on Cloud 2.4.9
This announcement does NOT apply to,
- Adobe Commerce as a Cloud Service (SaaS)
- Adobe Commerce On-Premise installations
Required Actions
Action 1 – Upgrade Third-Party Software Dependencies
Every environment must use supported versions of:
- PHP
- MariaDB
- OpenSearch
- Redis / Valkey
- RabbitMQ
Adobe recommends reviewing your .magento/services.yaml file to verify current versions.
Required Dependency Upgrades
| Dependency | Version | Must upgrade to | Deadline |
|---|---|---|---|
|
PHP |
8.1 and below |
8.2 or higher |
May 31, 2027 |
|
MariaDB/Galera |
10.5 and below |
10.6 or higher |
October 30, 2026 |
|
MariaDB/Galera |
Greater than 10.5 but lower than 10.11 |
10.11 or higher |
May 31, 2027 |
|
Elasticsearch |
any version |
OpenSearch: version 2.19 for 2.4.4 and 2.4.5 customers. Version 3 for 2.4.6 and above customers. |
October 30, 2026 |
|
OpenSearch |
1.x |
Version 2.19 for 2.4.4 and 2.4.5 customers. Version 3 for 2.4.6 and above customers. |
May 31, 2027 |
|
Redis |
5 and below |
Valkey version 8 or higher |
May 31, 2027 |
|
RabbitMQ |
3.9 and below |
Version 3.13 or higher |
October 30, 2026 |
|
RabbitMQ |
Greater than 3.9 but lower than 3.13 |
4.3 or higher |
May 31, 2027 |
Important Migration Considerations
Most dependency upgrades are straightforward version upgrades. However, Adobe highlights several upgrades that require additional planning.
Elasticsearch → OpenSearch
This is not simply a version upgrade. It involves migrating to an entirely different search engine. Custom integrations, third-party extensions, and custom indexing implementations may require updates.
Redis → Valkey
Valkey is now the recommended replacement for Redis. If your project directly references Redis-specific configurations or commands, you should thoroughly validate your application after migration.
PHP 8.1 → PHP 8.2
PHP 8.2 introduces several deprecations. Custom modules and third-party extensions should be reviewed carefully before upgrading. Running the Upgrade Compatibility Tool is highly recommended.
Action 2 – Upgrade Adobe Commerce Version
Besides infrastructure dependencies, Adobe also requires merchants to stay on supported Commerce versions.
Adobe Commerce Version Requirements
| Current Adobe Commerce Version | Required Action | Deadline |
|---|---|---|
|
2.4.4 or 2.4.5 |
Upgrade to Adobe Commerce 2.4.9 (or latest) or migrate to Adobe Commerce as a Cloud Service |
June 1, 2027 |
|
2.4.6 or 2.4.7 |
Upgrade to Adobe Commerce 2.4.9 (or latest) or migrate to Adobe Commerce as a Cloud Service |
June 1, 2028 |
|
2.4.8 or 2.4.9 |
No Commerce upgrade required at this time |
Not Applicable |
Overall Compliance Deadlines
| Adobe Commerce Version | Upgrade Third-Party Dependencies | Upgrade Adobe Commerce Version |
|---|---|---|
|
2.4.4 / 2.4.5 |
Required by October 30, 2026 |
Required by June 1, 2027 |
|
2.4.6 / 2.4.7 |
Required by October 30, 2026 or May 31, 2027 (depending on dependency) |
Required by June 1, 2028 |
|
2.4.8 / 2.4.9 |
Required by October 30, 2026 or May 31, 2027 (depending on dependency) |
Not required currently |
How to Check Your Current Environment
Check Adobe Commerce Version
bin/magento --version
Or simply check the version displayed at the bottom-right corner of the Admin Panel.
Check Cloud Service Versions
Review “magento/services.yaml”
Verify versions for:
- PHP
- MariaDB
- OpenSearch
- Redis / Valkey
- RabbitMQ
Adobe Will Perform Infrastructure Upgrades
Unlike on-premise installations, Commerce Cloud customers cannot directly upgrade platform services. Instead, Adobe requires customers to open a Support ticket requesting the upgrade.
Adobe recommends:
- Opening the request at least 30 days before the deadline
- Testing upgrades in Staging before Production
- Validating:
- Checkout
- Search
- Cart functionality
- Payment gateways
- ERP integrations
- Third-party extensions
- Custom modules
What Happens If You Ignore These Deadlines?
Adobe has clearly outlined the enforcement process.
If an environment fails to meet the required security standards:
- Adobe may suspend inbound traffic to the environment.
- The storefront becomes unavailable to customers.
- Continued non-compliance may result in cloud service termination.
- Hosted environments, branches, databases, and associated assets may be permanently deleted and cannot be recovered.
This makes compliance not only a security requirement but also a business continuity priority.
Best Practices Before Upgrading
To ensure a smooth transition, consider the following:
- Inventory all third-party extensions and verify compatibility.
- Run Adobe’s Upgrade Compatibility Tool to identify code changes.
- Test every dependency upgrade in non-production environments.
- Review custom integrations for Elasticsearch, Redis, and PHP compatibility.
- Schedule upgrades well before Adobe’s enforcement deadlines.
- Coordinate with Adobe Support and your implementation partner if customizations are extensive.
Rather than waiting until enforcement dates approach, merchants should start assessing their environments today. Upgrading dependencies, modernizing custom code, and staying on supported Adobe Commerce versions will not only ensure compliance but also improve performance, stability, and access to the latest platform innovations.
Treat these deadlines as an opportunity to strengthen your ecommerce platform rather than just another maintenance task. A proactive upgrade strategy today can save your business from unexpected downtime, security vulnerabilities, and costly emergency migrations in the future.