Toggle Nav
Search
Advanced Search

Magento 2 Security Patch Monitor

The Security Monitor Check module, part of our Swissuplabs Core extension, checks your store for missing Adobe security patches and shows a warning in Magento Admin when a patch for your Magento version isn't installed. It uses Adobe's official Commerce Version Tool (CVT).

What the warning means

  • One or more Adobe security patches for your Magento version weren't found in your code.
  • Adobe releases many security fixes as isolated patch files. They don't change the Magento version number, so the version alone won't show a missing patch.
  • A missing patch doesn't mean your store has been compromised, but it leaves a known, publicly documented vulnerability open. Treat it as a priority.

How the module works

  1. Check patch status. CVT checks which security patches apply to your Magento version and components, and which are installed.
  2. Identify missing patches. Patches that apply but aren't found are reported as missing, based on Adobe's patch information.
  3. Notify administrators. A notification appears in Magento Admin with a link to this page.
Screenshot: Swissuplabs Security Monitor Check notification in Magento Admin
The notification shows which Adobe security patches are missing.

Note: The module only reports. It doesn't install patches or change your code. It tracks Adobe's monthly security patches, so urgent hotfixes released outside that sequence (such as APSB26-146) may not be detected. Extensions and server software aren't checked.

What to do

  1. Review the warning. Note which patches are reported as missing.
  2. Contact your Magento developer or hosting provider. Ask them to verify the result (see Check patches from the command line).
  3. Apply the missing patches. See Find and apply a missing patch. Back up the store and test on staging before production.
  4. Check again. Run the check again and confirm no patches are reported as missing.

Check patches from the command line

Run from the Magento root directory. Requires PHP 8.1 or later and the system patch command.

# Is the tool installed?
php vendor/bin/patch-status --version

# Full report (JSON)
php vendor/bin/patch-status

# One row per CVE (CSV)
php vendor/bin/patch-status --format=csv

If the first command fails, the tool isn't installed. Install the July 2026 patch first.

Key fields in the report:

  • missing_patches: patches that apply to your store but aren't installed
  • unknown_patches: patches the tool couldn't confirm (details in var/log/patch_status.log)
  • vulnerability_status: each CVE as PROTECTED, VULNERABLE, UNKNOWN or NOT_APPLICABLE

Example (shortened):

"base_version": "2.4.6-p15",
"applied_patches": ["246p15-2026-07-001-CE"],
"missing_patches": ["246p15-2026-08-001-CE", "246p15-2026-09-001-CE"]

Install the tool (July 2026 patch)

The tool ships with Adobe's July 2026 security patch (APSB26-73 release notes). Applying the patch's CE file installs it at vendor/bin/patch-status.

  1. Check your exact version with php bin/magento --version. The patch only applies to the versions below. On an earlier patch level (for example 2.4.7-p8), upgrade first.
  2. Download and unzip the patch for your version:
    Magento versionDownload
    2.4.92-4-9-jul-2026.zip
    2.4.8-p52-4-8-p5-jul-2026.zip
    2.4.7-p102-4-7-p10-jul-2026.zip
    2.4.6-p152-4-6-p15-jul-2026.zip
    2.4.5-p17*2-4-5-p17-jul-2026.zip
    2.4.4-p18*2-4-4-p18-jul-2026.zip
    * Adobe Commerce only. Sign in with your Composer public key (username) and private key (password).
  3. Copy the patch files to the Magento root and apply them in order: CE, then EE (Adobe Commerce), then B2B if installed. If -p1 fails, try -p2. 
    patch -p1 < 246p15-2026-07-001-CE.patch
patch -p1 < 246p15-2026-07-001-EE.patch
  4. Flush the cache: php bin/magento cache:flush
  5. Confirm the tool works: php vendor/bin/patch-status --version

Adobe Commerce on Cloud: follow the Cloud steps in Adobe's release notes instead. Composer-built deployments: add the patches to your build (for example with cweagans/composer-patches) so the next deploy doesn't remove them.

Find and apply a missing patch

  1. Take the ID from missing_patches. For example, 246p15-2026-08-001-CE is the August 2026 CE patch for Magento 2.4.6-p15.
  2. Find the Adobe Commerce bulletin from that month in Adobe's security bulletins. August 2026, for example, is APSB26-92.
  3. In the bulletin's Solution section, open Release Notes. It has a ZIP download for each supported version. If there's none for your version, upgrade to a supported version first.
  4. Apply the file with the same name as the ID (246p15-2026-08-001-CE.patch) the same way as the July patch.

If several patches are missing, apply them oldest month first. Within a month, apply CE, then EE, then B2B.

Need help? If you don't have a Magento developer, contact us and we'll review your store's patch status with you.