Loading story…
Adobe Commerce and Magento Community Edition deployments are exposed to CVE-2025-54236, a critical improper-input-validation flaw (CWE-20) that allows a remote, unauthenticated attacker to take over user sessions without interaction. Public exploit code, including the Metasploit Magento SessionReaper module, is available, increasing the risk of account compromise, unauthorized access to customer and business data, and malicious activity in affected online stores.
Adobe released fixes for the vulnerability, and the Dutch National Cyber Security Centre urged organizations to apply the updates immediately and have providers confirm whether their installations are affected. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog; organizations should prioritize patching affected Adobe Commerce and Magento packages, validate remediation, and review sessions and store activity for signs of compromise.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
CVE-2025-54236, a critical improper-input-validation flaw affecting Adobe Commerce and Magento Community Edition, was published and patched. The vulnerability permits unauthenticated remote session takeover and has public exploit support, including the Magento SessionReaper Metasploit module.
Researchers demonstrated that an unauthenticated attacker could combine Web API nested deserialization, control of PHP's file-based session save path, and Magento's customer-address upload route to trigger PHP deserialization and achieve remote code execution as the web-server user. The published chain does not work with Redis-backed session storage, and the researchers reported it was blocked by Adobe's patch.
Adobe released security updates for multiple Adobe Commerce vulnerabilities that could enable security-control bypass, unauthorized access, and browser-executed malicious-code injection. The Dutch NCSC advised affected organizations to install the updates promptly and assess their exposure.
CISA listed CVE-2025-54236 in its Known Exploited Vulnerabilities catalog and set a remediation due date of November 14, 2025. The source does not state when the KEV listing occurred.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 36 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
6 references tracked. Mallory keeps watching after this page renders.
tenable.com
Open sourcencsc.nl
Open sourceslcyber.io
Open sourcesansec.io
Open sourcecwe.mitre.org
Open sourcephp.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Adobe released an out-of-band fix for **CVE-2025-54236**, a critical improper input validation flaw in **Adobe Commerce**, **Adobe Commerce B2B**, and **Magento Open Source** that allows unauthenticated attackers to take over user sessions through vulnerable session-handling and Web API components. The bug, dubbed **"SessionReaper"** by Sansec, carries a reported **CVSS 9.1** rating and can lead to account hijacking, exposure of customer data, fraudulent orders, administrative access, and in some scenarios potentially remote code execution. Affected releases span multiple 2.4.x branches, including versions from **2.4.4 through 2.4.7** and other listed builds and earlier releases. Security guidance escalated after reports said the flaw was being actively exploited in the wild and added to **CISA's Known Exploited Vulnerabilities** catalog. Adobe published remediation details in **APSB25-88** and shipped patched versions, while defenders were urged to apply the vendor fix immediately, verify patch status, review logs for anomalous session activity, tighten administrative access, and increase **WAF**, API, and **SIEM** monitoring. Advisories also warned that leaked hotfix details and unofficial fixes could accelerate attacker weaponization or create additional risk.
Jun 29, 2026Adobe has issued an emergency patch for CVE-2025-54236, a critical vulnerability dubbed SessionReaper affecting Adobe Commerce and Magento Open Source. The flaw allows unauthenticated attackers to take over customer accounts via the Commerce REST API and may enable remote code execution under certain conditions. No exploitation has been observed in the wild, but administrators are urged to apply the patch immediately due to the vulnerability's severity and potential for automated, large-scale abuse.
Jun 29, 2026
Hackers have begun actively exploiting the critical SessionReaper vulnerability (CVE-2025-54236) in Adobe Commerce (Magento) platforms, with security firm Sansec detecting and blocking hundreds of real-world attack attempts. The flaw, which allows attackers to take control of account sessions via the Commerce REST API, remains unpatched in approximately 62% of Magento stores, leaving thousands of e-commerce sites exposed to remote code execution and account takeover attacks. Technical analyses and proof-of-concept exploit code have been published, further increasing the risk of mass exploitation. Adobe issued an emergency patch for SessionReaper six weeks prior to the observed attacks, but patch adoption has been slow. Attackers are leveraging PHP webshells and probes to exploit the vulnerability, with most attacks originating from a handful of IP addresses. Security experts warn that the public availability of exploit details and the high impact of the flaw make rapid patching and the activation of web application firewalls critical for all affected organizations.
Jun 29, 2026