Adobe Commerce 2.4.8-p1 was released on Jun 10, 2025. Its end of life is Apr 11, 2028. Its current support status is supported.

Release date: Jun 10, 2025
End of life: Apr 11, 2028
Status: supported
Distribution: Adobe Commerce

2.4.8-p5 is the current release of the 2.4.8 line, published on May 12, 2026. Requirements below are the ones documented for 2.4.8-p1 — for the stack to deploy today, see Adobe Commerce 2.4.8-p5.

System requirements

Runtime

PHP 8.3, 8.4
Composer 2.9

Database

MySQL 8.4
MariaDB 11.4
AWS Aurora MySQL 8.0

Search

OpenSearch 2.19
AWS OpenSearch 2.5

Cache

Valkey 8
Varnish 7.6
AWS ElastiCache redis-7

Queue

RabbitMQ 4.1
AWS MQ 3.13

Web server & storage

nginx 1.26
Apache 2.4
AWS S3 supported

Security vulnerable

APSB25-88 critical CVE-2025-54236 fixed in 2.4.8-p2

Isolated patch: VULN-32437-2-4-X-patch
APSB25-71 critical CVE-2025-49557 fixed in 2.4.8-p2

Recommended: 2.4.8-p5

Applicable security patches

APSB25-50 critical CVE-2025-47110 fixed in this release

Stored cross-site scripting in the admin panel (CVE-2025-47110) that can be chained into arbitrary code execution when an administrator views the injected content. Fixed in the June 2025 patch set, including 2.4.8-p1.
APSB25-26 critical CVE-2025-27189 inherited from 2.4.8

Improper authorization (CVE-2025-27189) allowing a security feature bypass, published alongside the 2.4.8 general availability release. Older lines receive the fix through their April 2025 patch versions.

Previous and next releases

Previous 2.4.4-p14 Jun 5, 2025 Next 2.4.7-p6 Jun 10, 2025

JSON API

Get this release as JSON:

curl -s https://magento.watch/api/v1/magento-commerce/versions/2.4.8-p1