Magento Open Source 2.4.8-p4 was released on Mar 10, 2026. Its end of support is Apr 11, 2028. Its current support status is outdated — upgrade to 2.4.8-p5.

Release date: Mar 10, 2026
End of support: Apr 11, 2028
Status: outdated — upgrade to 2.4.8-p5
Distribution: Magento Open Source

2.4.8-p5 is the current release of the 2.4.8 line, published on May 12, 2026. Only the newest patch of a line counts as supported: upgrade 2.4.8-p4 to 2.4.8-p5 to get every fix shipped since. Requirements below are the ones documented for 2.4.8-p4 — for the stack to deploy today, see Magento Open Source 2.4.8-p5.

System requirements

Runtime

PHP 8.3, 8.4
Composer 2.9

Database

MySQL 8.4
MariaDB 11.4
AWS Aurora MySQL 8.0

Search

OpenSearch 3
AWS OpenSearch 2.5

Cache

Valkey 8
Varnish 7.7
AWS ElastiCache redis-7

Queue

RabbitMQ 4.1
ActiveMQ 2
AWS MQ 3.13

Web server & storage

nginx 1.28
AWS S3 supported

Security secure

No known open bulletins for this release.

Recommended: 2.4.8-p5

Applicable security patches

APSB25-88 critical CVE-2025-54236 inherited from 2.4.8-p2

Improper input validation in the Web API's service input processor (CVE-2025-54236), publicly known as SessionReaper. An unauthenticated attacker can hijack customer sessions through the REST API and, depending on configuration, reach remote code execution. Adobe shipped the out-of-band hotfix VULN-32437 before the regular patch release; it was the first emergency patch since CosmicSting.
APSB25-71 critical CVE-2025-49557 inherited from 2.4.8-p2

Improper access control (CVE-2025-49557) and related flaws that let an attacker bypass security features and reach functionality that should require authorization. Shipped with the regular August 2025 patch set for the 2.4.4 to 2.4.8 lines.
APSB25-50 critical CVE-2025-47110 inherited from 2.4.8-p1

Stored cross-site scripting in the admin panel (CVE-2025-47110) that can be chained into arbitrary code execution when an administrator views the injected content. Fixed in the June 2025 patch set, including 2.4.8-p1.
APSB25-26 critical CVE-2025-27189 inherited from 2.4.8

Improper authorization (CVE-2025-27189) allowing a security feature bypass, published alongside the 2.4.8 general availability release. Older lines receive the fix through their April 2025 patch versions.

Quality patches

142 Adobe Quality Patches Tool patches apply to Magento Open Source 2.4.8-p4. Browse and search them.

Previous and next releases

Previous 2.4.4-p16 Oct 14, 2025 Next 2.4.7-p9 Mar 10, 2026

JSON API

Get this release as JSON:

curl -s https://magento.watch/api/v1/magento-community/versions/2.4.8-p4