October 2024 Security Patch (APSB24-73) Released

October 8, 2024 saw Adobe release critical security patch APSB24-73, addressing multiple severe vulnerabilities affecting Adobe Commerce and other Enterprise products. Given the critical nature of the vulnerabilities, merchants should prioritise applying this patch immediately.

Vulnerability Severity

APSB24-73 addresses several high-severity vulnerabilities including remote code execution (RCE) risks. These vulnerabilities could allow attackers to execute arbitrary code on affected systems, potentially compromising merchant data, customer information, and operational integrity. The severity cannot be overstated: this is a patch that must be applied urgently.

Affected Systems

The patch applies to multiple Adobe Commerce versions. Merchants running any actively supported version should apply the patch without delay. Adobe provided a detailed advisory specifying affected versions and workarounds for merchants unable to patch immediately.

Patch Application Process

For cloud merchants, Adobe automatically applies critical patches. On-premises merchants must apply the patch manually. The process involves downloading the patch package, applying it to the codebase, running compilation and cache clearing steps, and deploying to production. Most patches can be applied in 1-2 hours for standard configurations.

Pre-Patch Verification

Before applying to production, merchants should test the patch on staging environments. Whilst security patches are typically low-risk, testing ensures compatibility with custom extensions and provides confidence before deploying to live systems.

Post-Patch Validation

After patching, merchants should verify that core commerce functions work correctly: product browsing, shopping cart operations, checkout, order placement, and API functionality. Comprehensive testing ensures the patch didn't introduce unexpected side effects.

Going Forward

This patch underscores the importance of maintaining current versions and applying security patches promptly. For merchants not on actively supported versions, this is a strong signal to plan upgrades. Staying current is not merely about new features—it's about security and operational safety.