CVE-2025-54236
Adobe Commerce | Improper Input Validation (CWE-20)
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Adobe Commerce | Improper Input Validation (CWE-20)
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.
- Record
CVE-2025-54236- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2025-27277
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.
- Record
EUVD-2025-27277- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-wh92-6q6g-px7j
Magento Community Edition Improper Input Validation vulnerability
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact to high. Exploitation of this issue does not require user interaction.
- Record
GHSA-wh92-6q6g-px7j- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CISA KEV No score
Adobe Commerce and Magento Improper Input Validation Vulnerability
Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API.
- Record
CVE-2025-54236- Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.
- Record
CVE-2025-54236- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Adobe Commerce | Improper Input Validation (CWE-20)
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.
- Record
CVE-2025-54236- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-wh92-6q6g-px7j
Magento Community Edition Improper Input Validation vulnerability
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact to high. Exploitation of this issue does not require user interaction.
- Record
GHSA-wh92-6q6g-px7j- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
magento/community-editionPackagist |
through 2.4.5-p14 | None known |
magento/community-editionPackagist |
2.4.6 to 2.4.6 | None known |
magento/community-editionPackagist |
2.4.6-p1 to 2.4.6-p12 | None known |
magento/community-editionPackagist |
2.4.5 to 2.4.5 | None known |
magento/community-editionPackagist |
2.4.9-alpha1 to 2.4.9-alpha2 | None known |
magento/community-editionPackagist |
2.4.7 to 2.4.7 | None known |
magento/community-editionPackagist |
2.4.8 to 2.4.8 | None known |
magento/community-editionPackagist |
2.4.7-beta1 to 2.4.7-p7 | None known |
magento/community-editionPackagist |
2.4.8-beta1 to 2.4.8-p2 | None known |
magento/community-editionPackagist |
2.4.9 to 2.4.9 | None known |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
magento/project-community-editionPackagist |
through 2.0.2 | None known |
magento/community-editionPackagist |
through 2.4.5-p14, plus listed versions 0.1.0-alpha1000.1.0-alpha1010.1.0-alpha1020.1.0-alpha1030.1.0-alpha104 Show 45 moreShow less0.1.0-alpha1050.1.0-alpha1060.1.0-alpha1070.1.0-alpha1080.1.0-alpha890.1.0-alpha900.1.0-alpha910.1.0-alpha920.1.0-alpha930.1.0-alpha940.1.0-alpha950.1.0-alpha960.1.0-alpha970.1.0-alpha980.1.0-alpha990.42.0-beta10.42.0-beta100.42.0-beta110.42.0-beta20.42.0-beta30.42.0-beta40.42.0-beta50.42.0-beta60.42.0-beta70.42.0-beta80.42.0-beta90.74.0-beta10.74.0-beta100.74.0-beta110.74.0-beta120.74.0-beta130.74.0-beta140.74.0-beta150.74.0-beta160.74.0-beta20.74.0-beta30.74.0-beta40.74.0-beta50.74.0-beta60.74.0-beta70.74.0-beta80.74.0-beta91.0.0-beta1.0.0-beta21.0.0-beta3 |
None known |
magento/community-editionPackagist |
Listed versions 2.4.6 |
None known |
magento/community-editionPackagist |
2.4.6-p1 to 2.4.6-p12, plus listed versions 2.4.6-p102.4.6-p112.4.6-p22.4.6-p32.4.6-p4 Show 5 moreShow less2.4.6-p52.4.6-p62.4.6-p72.4.6-p82.4.6-p9 |
None known |
magento/community-editionPackagist |
Listed versions 2.4.5 |
None known |
magento/community-editionPackagist |
Listed versions 2.4.7 |
None known |
magento/community-editionPackagist |
Listed versions 2.4.8 |
None known |
magento/community-editionPackagist |
2.4.7-beta1 to 2.4.7-p7, plus listed versions 2.4.72.4.7-beta22.4.7-beta32.4.7-p12.4.7-p2 Show 4 moreShow less2.4.7-p32.4.7-p42.4.7-p52.4.7-p6 |
None known |
magento/community-editionPackagist |
2.4.8-beta1 to 2.4.8-p2, plus listed versions 2.4.82.4.8-beta22.4.8-p1 |
None known |
magento/community-editionPackagist |
Listed versions 2.4.9 |
None known |
magento/project-community-editionPackagist |
through 2.0.2, plus listed versions 0.1.0-alpha1000.1.0-alpha1010.1.0-alpha1020.1.0-alpha1030.1.0-alpha104 Show 45 moreShow less0.1.0-alpha1050.1.0-alpha1060.1.0-alpha1070.1.0-alpha1080.1.0-alpha890.1.0-alpha900.1.0-alpha910.1.0-alpha920.1.0-alpha930.1.0-alpha940.1.0-alpha950.1.0-alpha960.1.0-alpha970.1.0-alpha980.1.0-alpha990.42.0-beta10.42.0-beta100.42.0-beta110.42.0-beta20.42.0-beta30.42.0-beta40.42.0-beta50.42.0-beta60.42.0-beta70.42.0-beta80.42.0-beta90.74.0-beta10.74.0-beta100.74.0-beta110.74.0-beta120.74.0-beta130.74.0-beta140.74.0-beta150.74.0-beta160.74.0-beta20.74.0-beta30.74.0-beta40.74.0-beta50.74.0-beta60.74.0-beta70.74.0-beta80.74.0-beta91.0.0-beta2.0.02.0.0-rc |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | amalpvatayam67/day01-sessionreaper-lab | 2025-09-10 |
| PoC in GitHub | wubinworks/magento2-session-reaper-patch | 2025-10-19 |
| Metasploit | Magento SessionReaper | 2025-10-22 |
| PoC in GitHub | Baba01hacker666/cve-2025-54236 | 2025-12-30 |
| PoC in GitHub | alexb616/SessionReaper-CVE-2025-54236 | 2026-03-19 |
| PoC in GitHub | Jenderal92/magento-upload-auto-submit-zoneh | 2026-05-13 |
| PoC in GitHub | brito101/session_reaper_lab | 2026-05-24 |
| PoC in GitHub | Dx3iZ/CVE-2025-54236 | 2026-07-06 |
| Nuclei | Adobe Commerce - Authentication Bypass |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-54236 is a critical vulnerability (CVSS 9.1) in Adobe Commerce, published September 9, 2025. CISA lists it as known to be exploited, since October 24, 2025. EUVD reports exploitation since October 24, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 95.4%, the 99th percentile. No source names a fixed version.
References
helpx.adobe.com/security/products/magento/apsb25-88.html
nullsecurityx.codes/cve-2025-54236-sessionreaper-unauthenticated-rce-in-magento
experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-27397
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54236
nvd.nist.gov/vuln/detail/CVE-2025-54236
github.com/advisories/GHSA-wh92-6q6g-px7j
Left out here: 117 versions. The JSON record has them.