CVE-2025-54236
Published 2025-09-09 · Updated 2026-06-17 · Source psirt@adobe.com
Summary
CVE-2025-54236 is a critical-severity (CVSS 9.1) vulnerability in Adobe Commerce and Magento. CISA added it to the Known Exploited Vulnerabilities catalog on October 24, 2025, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by November 14, 2025. CISA does not currently list it as used in ransomware campaigns. Adobe has 83 vulnerabilities in the KEV catalog, 11 of them linked to ransomware.
All 83 known-exploited Adobe vulnerabilities →Description
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA Known-Exploited Vulnerability
Product: Adobe — Commerce and Magento
Name: Adobe Commerce and Magento Improper Input Validation Vulnerability
Date added: 2025-10-24 · Due: 2025-11-14
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
References
- https://helpx.adobe.com/security/products/magento/apsb25-88.html
- https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-27397
- https://nullsecurityx.codes/cve-2025-54236-sessionreaper-unauthenticated-rce-in-magento
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54236