CVE-2025-54236

Published Sep 9, 2025

Last updated 11 hours ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-54236, also known as SessionReaper, is a vulnerability affecting Adobe Commerce and Magento installations. It stems from improper input validation in the Magento Web API. Successful exploitation could lead to security feature bypass, potentially allowing attackers to take over customer accounts, steal data, and place fraudulent orders. The vulnerability allows unauthenticated remote code execution. The attack combines a malicious session with a nested deserialization bug in Magento's REST API. Exploitation appears to require file-based session storage. Adobe has released an emergency patch to address this critical flaw.

Description: Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.
Source: psirt@adobe.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.1
Impact score: 5.2
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Severity: CRITICAL

Weaknesses

psirt@adobe.com: CWE-20

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 28

References