Critical Adobe Commerce Session Hijack Flaw Added to KEV After Active Exploitation
Active Exploitation · 5 sources · Updated 4mo ago · First seen Apr 23, 2026
Adobe released an out-of-band fix for CVE-2025-54236, a critical improper input validation flaw in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source that allows unauthenticated attackers to take over user sessions through vulnerable session-handling and Web API components. The bug, dubbed "SessionReaper" by Sansec, carries a reported CVSS 9.1 rating and can lead to account hijacking, exposure of customer data, fraudulent orders, administrative access, and in some scenarios potentially remote code execution. Affected releases span multiple 2.4.x branches, including versions from 2.4.4 through 2.4.7 and other listed builds and earlier releases.
Security guidance escalated after reports said the flaw was being actively exploited in the wild and added to CISA's Known Exploited Vulnerabilities catalog. Adobe published remediation details in APSB25-88 and shipped patched versions, while defenders were urged to apply the vendor fix immediately, verify patch status, review logs for anomalous session activity, tighten administrative access, and increase WAF, API, and SIEM monitoring. Advisories also warned that leaked hotfix details and unofficial fixes could accelerate attacker weaponization or create additional risk.
