CVE-2025-54236
Adobe Commerce and Magento Improper Input Validation Vulnerability
Description
CVE-2025-54236 is a critical improper input validation vulnerability affecting Adobe Commerce and Magento versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier. The flaw allows an unauthenticated attacker to achieve session takeover, resulting in high impact to both confidentiality and integrity without any user interaction required. This vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of November 14, 2025, and carries an EPSS score of 69.2% (98.6th percentile), indicating a very high probability of active exploitation. Organizations running affected Adobe Commerce or Magento installations should treat remediation as an urgent priority.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| adobe | commerce | 2.4.4; 2.4.5; 2.4.6; 2.4.7; 2.4.8; 2.4.9 |
| adobe | commerce b2b | 1.3.3; 1.3.4; 1.4.2; 1.5.2; 1.5.3 |
| adobe | magento | 2.4.5; 2.4.6; 2.4.7; 2.4.8; 2.4.9 |
References
- https://helpx.adobe.com/security/products/magento/apsb25-88.html(Vendor Advisory)
- https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-27397(Vendor Advisory)
- https://nullsecurityx.codes/cve-2025-54236-sessionreaper-unauthenticated-rce-in-magento(Broken Link, Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54236(US Government Resource)
Weakness Type
CWE-20: Improper Input Validation
CWE-20 describes a condition where software fails to properly validate input before it is processed, allowing attackers to craft data that causes unintended behavior. In the context of CVE-2025-54236, inadequate input validation in Adobe Commerce and Magento enables an attacker to manipulate session data and take over authenticated sessions without any prior authentication. This weakness category is one of the most prevalent root causes for web application vulnerabilities, as it can lead to a wide range of exploitable conditions from injection attacks to authentication bypasses.
Impact Analysis
The business impact of CVE-2025-54236 is severe. Confidentiality impact is high because a successful session takeover gives the attacker access to all data visible to the compromised user, including customer records, order history, payment information, and administrative settings. Integrity impact is equally high, as the attacker can modify orders, alter product listings, change pricing, and manipulate store configuration under the hijacked session. Availability is not directly affected by this vulnerability, though secondary actions taken by an attacker with administrative access could disrupt operations.
With an EPSS score of 69.2%, placing it in the 98.6th percentile, the probability of this vulnerability being exploited in the wild is exceptionally high. The vulnerability has been confirmed in CISA's KEV catalog, meaning active exploitation has been observed. The ransomware association is currently listed as unknown, but the ability to gain administrative control over e-commerce platforms makes this an attractive target for financially motivated attackers. Organizations that process transactions through Adobe Commerce or Magento face significant regulatory and financial risk if this vulnerability remains unpatched, including potential PCI DSS compliance violations.
Exploit Maturity
CVE-2025-54236 has confirmed active exploitation in the wild, as evidenced by its inclusion in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of November 14, 2025. The EPSS score of 69.2% (98.6th percentile) reflects extremely high exploitation probability. A public exploit has been documented at nullsecurityx.codes, which describes an unauthenticated attack vector referred to as "SessionReaper." The ransomware usage status is currently unknown, though the critical nature of the vulnerability and its presence in e-commerce platforms make it a high-value target for threat actors seeking financial gain. Given the availability of public exploit code and the unauthenticated nature of the attack, the exploit maturity should be considered very high.
Remediation
- Apply the latest Adobe security patches immediately. Refer to Adobe Security Bulletin APSB25-88 and update Adobe Commerce to the patched versions (2.4.9-alpha2 or later patch, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, or 2.4.4-p15 with applicable hotfixes).
- Review session management configurations. Audit your Adobe Commerce or Magento session handling settings to ensure session tokens are rotated on authentication events and session fixation protections are enabled.
- Inspect server logs for indicators of compromise. Look for unusual session creation patterns, unexpected administrative actions, or access from unfamiliar IP addresses that may indicate prior exploitation.
- Enable web application firewall (WAF) rules. Deploy or update WAF rules to detect and block session manipulation attempts targeting the identified input validation weakness.
- Monitor the CISA KEV catalog and Adobe advisories for updates. Continue tracking CISA's KEV listing and Adobe's Experience League article for any additional guidance or supplementary patches.
Technical Details
The CVSS v3.1 base score for CVE-2025-54236 is 9.1 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. Attack Vector (AV:N) indicates the vulnerability is exploitable remotely over the network, requiring no physical or local access. Attack Complexity (AC:L) means no special conditions or circumstances are needed to exploit the flaw. Privileges Required (PR:N) confirms that an attacker needs no prior authentication or credentials. User Interaction (UI:N) means the attack succeeds without any action from a legitimate user. Scope (S:U) is unchanged, meaning the vulnerability affects only the vulnerable component itself. Confidentiality (C:H) and Integrity (I:H) are both rated high, reflecting the session takeover capability. Availability (A:N) is none, as the attack does not directly cause a denial of service.
The underlying attack mechanism exploits improper input validation in the session handling logic of Adobe Commerce and Magento. The attacker sends crafted requests to the application that bypass normal session validation checks, allowing them to hijack an existing authenticated session. Because no privileges or user interaction are required, the attack surface is maximized. Once session takeover is achieved, the attacker inherits the full permissions of the compromised user, which in the case of an administrator session provides complete control over the e-commerce platform.
Frequently Asked Questions
What is CVE-2025-54236?
CVE-2025-54236 is a critical improper input validation vulnerability in Adobe Commerce and Magento that allows an unauthenticated attacker to take over user sessions. This can lead to unauthorized access to sensitive data and the ability to modify store configurations, orders, and product information.
Is CVE-2025-54236 being actively exploited?
Yes. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. A public exploit known as "SessionReaper" has been disclosed, and the EPSS score of 69.2% places it in the 98.6th percentile for exploitation probability.
Which versions of Adobe Commerce and Magento are affected?
Affected versions include Adobe Commerce 2.4.4 through 2.4.9-alpha2, Adobe Commerce B2B 1.3.3 through 1.5.3, and Magento Open Source 2.4.5 through 2.4.9. Organizations should consult Adobe Security Bulletin APSB25-88 for the specific patched version applicable to their installation.
How can I protect my Adobe Commerce store from this vulnerability?
The most effective protection is to apply the patches referenced in Adobe Security Bulletin APSB25-88 immediately. Additionally, review session management settings, enable WAF rules to detect session manipulation, and audit server logs for signs of prior exploitation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.