What’s Vulnerable › Vulnerabilities

CVE-2025-54236: Adobe Commerce | Improper Input Validation (CWE-20)

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2025-10-24
• EPSS: 95.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-09-09 · updated 2026-06-17
• Weakness: CWE-20

Description

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.

Affected products

• Adobe Commerce: 2.4.4, 2.4.4-p1, 2.4.4-p10, 2.4.4-p11, 2.4.4-p12, 2.4.4-p13 (+56)
• Adobe Commerce: 1.3.3, 1.3.3-p1, 1.3.3-p10, 1.3.3-p11, 1.3.3-p12, 1.3.3-p13 (+38)
• Adobe Magento: 2.4.5, 2.4.5-p1, 2.4.5-p10, 2.4.5-p11, 2.4.5-p12, 2.4.5-p13 (+40)
• Adobe Commerce: through 2.4.4-p15

References

• https://helpx.adobe.com/security/products/magento/apsb25-88.html
• https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-27397
• https://nullsecurityx.codes/cve-2025-54236-sessionreaper-unauthenticated-rce-in-magento
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54236

Get alerted when CVE-2025-54236 or the next vulnerability affects your stack