On August 12, 2025, Adobe released a security update for Adobe Commerce and Magento Open Source. Adobe Commerce security update APSB25-71 addresses critical and important vulnerabilities that could learn to security feature bypass, privilege escalation, arbitrary file system read, and application denial-of-service.
Key Vulnerabilities Addressed by Adobe Commerce
In update APSB25-71, Adobe addressed various security vulnerabilities, including:
- Improper Input Validation
- Cross-Site Request Forgery (CSRF)
- Incorrect Authorization
- Cross-Site Scripting (Stored XSS)
- Time-of-Check Time-of-Use (TOCTOU) Race Condition
- Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)
These vulnerabilities cause significant security risks, making it crucial for businesses to apply the update immediately to prevent potential security breaches.
Affected Versions
The update impacts various versions of Adobe Commerce and Magento Open Source, including:
- Adobe Commerce: 2.4.9-alpha1, 2.4.8-p1 and earlier, 2.4.7-p6 and earlier, 2.4.6-p11 and earlier, 2.4.6-p13 and earlier, 2.4.4-p14 and earlier
- Adobe Commerce B2B:1.5.3-alpha1, 1.5.2-p1 and earlier, 1.4.2-p6 and earlier, 1.3.5-p11 and earlier, 1.3.4-p13 and earlier, 1.3.3-p14 and earlier
- Magento Open Source: 2.4.9-alpha1, 2.4.8-p1 and earlier, 2.4.7-p6 and earlier, 2.4.6-p11 and earlier, 2.4.5-p13 and earlier
Version-Specific Solutions and Security Fixes by Adobe Commerce
The update delivers security solutions for impacted Adobe Commerce/Magento Open Source versions, including:
- Adobe Commerce: 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15
- Adobe Commerce B2B: 1.5.3-alpha2, 1.5.2-p2, 1.4.2-p7, 1.3.4-p14, 1.3.3-p15
- Magento Open Source: 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14
Recommended Action
Adobe Commerce recommends that users apply the patches instantly to minimize exposure to vulnerabilities/risks and improve solution security.
How to Install the Update?
Step 1: Download the relevant patch files.
Step 2: Install the security patch on a staging platform first.
Step 3: Verify successful installation on the staging by checking patch status using the provided tools.
Step 4: Deploy the update on the live platform after confirming stability on staging.
To enhance systems’ security, companies should update their software, implement strong access controls, and monitor suspicious activities to mitigate security threats.
As an Adobe Commerce certified partner, ioVista ensures seamless implementation of the security patch APSB25-71 without disturbing your ongoing eCommerce operations. Connect with our certified experts to install this security update.