CVE-2025-54236criticalunder attackCWE-20

CVE-2025-54236: critical vulnerability in Adobe Commerce

Adobe Commerce | Improper Input Validation (CWE-20)

Published · Updated

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.1epss 95%
from disclosure to weapon1 days
Published on NVDSep 9
1st PoC+1d
metasploit+43d
CISA KEV+45d
exploitation probability
95%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
12 public exploit(s)
Action required by CISAfederal deadline: 2025-11-14

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Adobe Commerce has a flaw that fails to properly check user input, allowing attackers to take over customer or admin sessions without any user action. This gives attackers full access to accounts and sensitive data.

Technical detail

Improper input validation in affected Adobe Commerce versions (2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier) enables unauthenticated session hijacking. The vulnerability allows attackers to craft malicious input that bypasses validation controls, leading to unauthorized session establishment without requiring user interaction, resulting in high confidentiality and integrity impact.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
Adobe · Adobe Commerce
public PoCs found — 12
githubgithub.com/wubinworks/magento2-session-reaper-patch★ 3githubgithub.com/alexb616/SessionReaper-CVE-2025-54236★ 1githubgithub.com/brito101/session_reaper_lab★ 0githubgithub.com/amalpvatayam67/day01-sessionreaper-lab★ 0githubgithub.com/Baba01hacker666/cve-2025-54236★ 0githubgithub.com/Jenderal92/magento-upload-auto-submit-zoneh★ 0vulncheckvulncheck.com/xdb/5dfcb430791eunverifiedvulncheckvulncheck.com/xdb/304e1752b46funverifiedvulncheckvulncheck.com/xdb/b8e03f7b8ecbunverifiedvulncheckvulncheck.com/xdb/2cd63b037b5dunverifiedvulncheckvulncheck.com/xdb/b26966a25b77unverifiedcve_referencenullsecurityx.codes/cve-2025-54236-sessionreaper-unauthenticated-rce-in-magentounverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Adobe Commerce

In the same product, most dangerous first.

CVE-2024-34102CRITICALXXE can expose crypt key and other secrets granting full admin accessEPSS 100.0%KEVCVE-2026-71362CRITICALAdobe Commerce | Incorrect Authorization (CWE-863)EPSS 87.5%KEVCVE-2026-75650CRITICALAdobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)EPSS 3.9%KEVCVE-2025-24434CRITICALAdobe Commerce | Incorrect Authorization (CWE-863)EPSS 17.2%CVE-2024-20720CRITICALCommand injection in data collector backup due to insufficient patching of CVE-2023-38208EPSS 3.7%CVE-2021-36023CRITICALMagento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code ExecutionEPSS 2.4%
References
https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-27397https://helpx.adobe.com/security/products/magento/apsb25-88.htmlhttps://nullsecurityx.codes/cve-2025-54236-sessionreaper-unauthenticated-rce-in-magentohttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54236