Vulnerability record · CVE-2025-54236 · published 9 September 2025
CVE-2025-54236: Adobe Commerce improper input validation enables session takeover
Adobe · Commerce
Adobe Commerce and Magento are affected by improper input validation (CWE-20) across multiple 2.4.x branches and earlier. A remote, unauthenticated attacker can abuse the flaw to take over user sessions, with high confidentiality and integrity impact. It is in CISA KEV with a very high EPSS score, so it should be treated as actively exploited and urgent.
Description
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Automated analysis
critical priorityUnauthenticated, no-interaction session takeover with CVSS 9.1, KEV listing and near-maximum EPSS makes this an urgent patch-first issue.
What it is
Adobe Commerce and Magento are affected by improper input validation (CWE-20) across multiple 2.4.x branches and earlier. A remote, unauthenticated attacker can abuse the flaw to take over user sessions, with high confidentiality and integrity impact. It is in CISA KEV with a very high EPSS score, so it should be treated as actively exploited and urgent.
Impact
An attacker gains control of another user's session, exposing and modifying data available to that account. Depending on the hijacked session's privileges, this can lead to broader compromise of the Commerce or Magento deployment.
Attack surface
Reachable over the network with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any internet-exposed Adobe Commerce or Magento instance on an affected version is in scope.
Exploitation
Listed in CISA KEV (added 2025-10-24) and EPSS 30-day probability is 0.945 (99.8th percentile), indicating active exploitation. A third-party reference is tagged Exploit, though that link is marked broken; no ransomware campaign use is documented.
What to do
- Apply the vendor fix from Adobe security bulletin APSB25-88 for your Commerce/Magento version, or upgrade past the affected releases.
- If patching cannot be done immediately, apply the mitigations in Adobe's guidance and CISA's KEV required action, including BOD 22-01 handling for cloud services.
- Restrict or block public access to affected Commerce/Magento admin and storefront endpoints where operationally feasible.
- Rotate session and authentication secrets and force re-authentication for privileged accounts after patching.
- Monitor Adobe and CISA advisories for updated guidance until remediation is complete.
Detection
- Hunt for anomalous session token reuse or session identifiers appearing from multiple source IPs or user agents.
- Review web and application logs for unusual requests to Commerce/Magento endpoints that precede session changes or privilege escalation.
- Alert on new or unexpected admin sessions and on authentication events that do not match normal user behavior.
- Correlate outbound or lateral activity from Commerce/Magento hosts with session takeover indicators.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2025-54236 to the Known Exploited Vulnerabilities catalog on 24 October 2025 as "Adobe Commerce and Magento Improper Input Validation Vulnerability". Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 14 November 2025.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://helpx.adobe.com/security/products/magento/apsb25-88.html | Vendor Advisory |
| https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-27397 | Vendor Advisory |
| https://nullsecurityx.codes/cve-2025-54236-sessionreaper-unauthenticated-rce-in-magento | Broken LinkExploitThird Party Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54236 | US Government Resource |
Track CVE-2025-54236 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2025-54236), CISA KEV, FIRST EPSS (scores of 2026-09-22). This page is refreshed as NVD updates the record.
