APSB25-71: Security update available for Adobe Commerce

APSB25-71 (published 2025-08-12) fixes 1 CVE in Adobe Commerce and Magento Open Source 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier; fixed in 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15.

Improper access control (CVE-2025-49557) and related flaws that let an attacker bypass security features and reach functionality that should require authorization. Shipped with the regular August 2025 patch set for the 2.4.4 to 2.4.8 lines.

Published

Aug 12, 2025

Severity

critical

CVEs

1

Isolated patch

no

CVEs

Fixed in

Magento Open Source

2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15

Adobe Commerce

2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15

Mage-OS

—

References

• https://helpx.adobe.com/security/products/magento/apsb25-71.html

For integrators

Get this bulletin as JSON:

curl -s https://magento.watch/api/v1/security-bulletins/APSB25-71