Search/CVE-2025-54236
● CVE — Critical

CVE-2025-54236

VendoradobeProductmagento, commerce, commerce b2bDiscoveredSep 9, 2025UpdatedMay 11, 2026

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.

View graph Watch Export
CVSS v3.1
9.1 CRITICAL
EPSS
95.4%
probability of exploitation in 30 days
CISA KEV
Listed
confirmed active exploitation
News coverage
9
sources referencing this CVE
Related IOCs
11
seen in the same coverage
EPSS Trend
Aug 16, 2026 → Oct 31, 2026
▲ 0.82pp
94.5% → 95.4% over 3 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityNONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Connections
16 relationships
Timeline
disclosure → media coverage
Sep 9, 2025
Disclosure — published as a CVE record. · last revised by NVD May 11, 2026
Sep 9, 2025
bleepingcomputer.com reports: Adobe patches critical SessionReaper flaw in Magento eCommerce platform
Sep 10, 2025
thehackernews.com reports: Adobe Commerce Flaw CVE-2025-54236 Lets Hackers Take Over Customer Accounts
Sep 10, 2025
redhotcyber.com reports: Vulnerabilità critica in Adobe Commerce e Magento: il bug SessionReaper
Oct 22, 2025
bleepingcomputer.com reports: Hackers exploiting critical "SessionReaper" flaw in Adobe Magento
Oct 23, 2025
thehackernews.com reports: Over 250 Magento Stores Hit Overnight as Hackers Exploit New Adobe Commerce Flaw
Oct 23, 2025
helpnetsecurity.com reports: Critical Adobe Commerce, Magento vulnerability under attack (CVE-2025-54236)
Oct 26, 2026
securityweek.com reports: 953 Online Stores Infected in Long-Lasting Malware Campaign
Oct 26, 2026
thehackernews.com reports: Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento
Oct 27, 2026
infosecurity-magazine.com reports: Hackers Infect 953 Online Stores With Scanner-Evading Code
Public PoC (7)
github.com/amalpvatayam67/day01-sessionreaper-labgithub.com/wubinworks/magento2-session-reaper-patchgithub.com/Baba01hacker666/cve-2025-54236github.com/alexb616/SessionReaper-CVE-2025-54236github.com/Jenderal92/magento-upload-auto-submit-zonehgithub.com/brito101/session_reaper_labgithub.com/Dx3iZ/CVE-2025-54236
Unverified third-party code — review before executing.