Adobe Commerce Patching Automation, Set Up and Run Properly
Adobe now ships security fixes every month. Patching Automation applies them from the Admin in under an hour. We make sure each one also leaves your checkout, payments and integrations working.
What Is Adobe Commerce Patching Automation?
Adobe Commerce Patching Automation, formerly the Cloud Automation Patching Service (CAPS), is an Adobe tool for Adobe Commerce on Cloud projects. You open it from Reports › System Insights › Site-Wide Analysis Tool in the Admin. It lists the patches available for a project and environment and applies or reverts them in one click. Each patch is tested in a temporary environment first, then health-checked after it goes live.
| Who it's for | Adobe Commerce on Cloud merchants and partners |
| Who can apply patches | Project admins (all environments) and Contributors (their assigned environments) |
| Where patches go | The m2-hotfixes folder |
| Run time | 45 to 60 minutes per patch |
| Git hosting | Cloud Git, or github.com through the Patching Automation GitHub App |
Why It Matters Now
Since 2026, Adobe has released isolated security patches every month on Patch Tuesday. The October 2026 bulletin (APSB26-153) covered versions 2.4.4 to 2.4.9. These patches are not cumulative, so if you miss a month, you have to apply it before the next one. Each patch also assumes you're on the latest -p release for your version line. Twelve rounds a year across staging and production is where teams start skipping patches. The tool removes most of the manual work, but it doesn't know how your store works.
How It Works
- Preliminary check
- Confirms the patch matches your version and doesn't conflict with your code. On production, it won't start unless maintenance mode is on and cron is off.
- Patching
- Creates a temporary branch ({environment}-CAPS-{patch-id}), deploys the patch there, checks that the app starts, then merges into your environment.
- Validation
- Runs a health check on your live environment and removes the temporary branch.
Worth knowing: the temporary branch gets your code but not your data, so issues that only show up with real orders won't appear there. And if the final health check fails, nothing is rolled back automatically.
Where the Tool Stops
- Cron and maintenance mode: The tool doesn't switch them for you. Someone sets both before a production run and restores them afterwards.
- A light health check: It confirms the app, database and cache respond. Checkout, payment fields, search and ERP syncs aren't tested.
- Merge conflicts: A conflict stops the run. Heavily customized stores sometimes need a developer to resolve it.
- Reverting: You can only revert patches the tool applied. Manual or Composer patches have to be removed by hand.
- Environment slots: Each run needs a free integration environment. If your slots are full, the run fails
- GitHub setup: You need the GitHub App installed and fetch-branches turned on. GitHub on a custom domain isn't supported.
- Banner: Patching Automation is built for Cloud projects. On-premises, Open Source and Mage-OS stores patch manually, and we run that process too.
Do You Need a Partner?
Not always. Here's our honest view.
You can run it yourself if…
- Your store is on Cloud with light customization
- You have an in-house developer who can revert a patch quickly
- Your staging environment matches production
Bring us in if…
- You have a custom checkout, Hyvä, hosted payment fields or B2B pricing that need testing before production
- Your ERP or CRM syncs run on cron and need checking after every patch
- You're on-premises, Open Source or Mage-OS, where this tool doesn't apply
How Evrig Runs Your Patching
Setup (once)
- We check user roles, install the GitHub App, free an environment slot, check Composer keys, and bring you up to the latest -p release with no missed patches.
Every month, after Patch Tuesday
- Review. We read the bulletin and check which fixes affect the modules you use.
- Check. We run the Commerce Version Tool (php vendor/bin/patch-status) to see exactly what's installed and what's missing.
- Test. We patch staging, then test checkout, payments, Hyvä components, search and ERP order syncs, whichever apply to your store.
- Deploy. We patch production in an agreed window and handle maintenance mode and cron for you.
- Report. We re-check with the Commerce Version Tool and send you a short report.
If a run fails: we trace the error to its cause, whether that's a failed deployment, a full environment slot, missing Composer access or a failed health check. We fix it, or raise it with Adobe Support with the IDs and logs they ask for.
Before Your First Production Patch
- Project admin or Contributor role on the target environment
- Last deployment succeeded
- One integration environment slot free
- Composer keys valid and store on the latest -p release
- GitHub App installed with fetch-branches on (GitHub projects only)
- Patch tested on staging, and someone available to revert
Engagement Options
Readiness Setup : One-time setup and a supervised first run, for teams who want to run patching themselves.
Managed Monthly Patching : We run the full monthly cycle for you, including testing and a report.
Part of Your Support Plan: Patching combined with development hours and incident response.
Pricing depends on how far behind your patches are, how many environments you have, how much custom code and how many integrations you run, and whether your testing is automated.
Why Evrig
Adobe Silver Partner: We work with Adobe Commerce Cloud every day, including its environments, deployment tools and release cycle.
Hyvä Gold Partner: We know which Hyvä and Magewire parts a core patch can touch.
Integration specialists: NetSuite, Epicor P21 and HubSpot integrations are everyday work for us, so we test what Adobe's health check skips.
One process, any edition: The same patching discipline for Cloud, Open Source and Mage-OS stores.
Make Patch Tuesday a routine, not a risk.
Tell us your version, hosting and integrations. We'll check where your store stands on patches and suggest a monthly plan. Book a Patching Review