Adobe Commerce 2.4.5-p9 was released on Aug 13, 2024. Its end of life is Aug 11, 2026. Its current support status is eol.

Release date: Aug 13, 2024
End of life: Aug 11, 2026
Status: eol
Distribution: Adobe Commerce

2.4.5-p17 is the current release of the 2.4.5 line, published on May 12, 2026. Requirements below are the ones documented for 2.4.5-p9 — for the stack to deploy today, see Adobe Commerce 2.4.5-p17.

System requirements

Runtime

PHP 8.1
Composer 2.2

Database

MySQL 8.0
MariaDB 10.4, 10.5
AWS Aurora MySQL 8.0

Search

OpenSearch 1.2
Elasticsearch 7.17
AWS OpenSearch 1.2
AWS Elasticsearch 7.9

Cache

Redis 7.2
Varnish 7.5
AWS ElastiCache redis-6

Queue

RabbitMQ 3.13
AWS MQ 3.9.13

Web server & storage

nginx 1.26
Apache 2.4
AWS S3 supported

Security eol

APSB25-88 critical CVE-2025-54236 fixed in 2.4.5-p14
APSB25-71 critical CVE-2025-49557 fixed in 2.4.5-p14
APSB25-50 critical CVE-2025-47110 fixed in 2.4.5-p13
APSB25-26 critical CVE-2025-27189 fixed in 2.4.5-p12
APSB25-08 critical CVE-2025-24434 fixed in 2.4.5-p11
APSB24-73 critical CVE-2024-45115 fixed in 2.4.5-p10

Recommended: 2.4.5-p17

Applicable security patches

APSB24-61 critical CVE-2024-39397 fixed in this release

Unrestricted upload of a file with a dangerous type (CVE-2024-39397) allowing arbitrary code execution by an unauthenticated attacker; Adobe notes the exploit requires the Apache web server. Fixed in the August 2024 patch set.
APSB24-40 critical CVE-2024-34102 inherited from 2.4.5-p8

XML external entity injection in the REST API (CVE-2024-34102), publicly known as CosmicSting. An unauthenticated attacker can read arbitrary files such as env.php and, chained with the glibc iconv bug CVE-2024-2961, execute code. Mass exploitation followed within weeks; Adobe also released an isolated patch for stores that could not upgrade.
APSB24-18 critical CVE-2024-20758, CVE-2024-20759 inherited from 2.4.5-p7

Improper input validation (CVE-2024-20758) enabling arbitrary code execution by an authenticated administrator, plus stored cross-site scripting (CVE-2024-20759). Published with the 2.4.7 general availability release and the April 2024 patch set.

Previous and next releases

Previous 2.4.6-p7 Aug 13, 2024 Next 2.4.4-p10 Aug 13, 2024

JSON API

Get this release as JSON:

curl -s https://magento.watch/api/v1/magento-commerce/versions/2.4.5-p9