Mass Exploitation of Magento SessionReaper (CVE-2025-54236) to Hijack Admin Sessions and Gain Root Access
Active Exploitation · 2 sources · Updated 4mo ago · First seen Jan 30, 2026
Threat actors conducted a mass exploitation campaign against Magento e-commerce deployments by abusing CVE-2025-54236 (aka SessionReaper), an authentication/session management flaw that allows attackers to bypass login controls by reusing improperly invalidated session tokens. Reporting based on an Oasis Security investigation described large-scale scanning that identified 1,000+ exposed/vulnerable Magento Commerce APIs and confirmed compromises of 200+ websites (with one count citing 216 victim sites), indicating broad weaponization by multiple actors across regions.
After hijacking valid admin sessions via replayed “zombie” tokens, intruders escalated privileges to achieve root-level control of affected Linux servers, enabling follow-on actions such as deploying web shells for persistent remote command execution and full administrative takeover of storefront infrastructure. Separately, research on eSkimming/Magecart activity highlighted that browser-based JavaScript payment-card theft remains persistent across e-commerce sites—often via third-party script/supply-chain compromise—and a longitudinal study of 550 previously compromised sites found 18% still infected a year later, underscoring that e-commerce compromises frequently involve durable footholds and re-compromise even after initial cleanup.
