Critical Adobe Commerce SessionReaper Flaw Enables Unauthenticated Session Takeover
Active Exploitation · 6 sources · Updated 2mo ago · First seen Sep 9, 2025
Adobe Commerce and Magento Community Edition deployments are exposed to CVE-2025-54236, a critical improper-input-validation flaw (CWE-20) that allows a remote, unauthenticated attacker to take over user sessions without interaction. Public exploit code, including the Metasploit Magento SessionReaper module, is available, increasing the risk of account compromise, unauthorized access to customer and business data, and malicious activity in affected online stores.
Adobe released fixes for the vulnerability, and the Dutch National Cyber Security Centre urged organizations to apply the updates immediately and have providers confirm whether their installations are affected. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog; organizations should prioritize patching affected Adobe Commerce and Magento packages, validate remediation, and review sessions and store activity for signs of compromise.
