Loading story…
Adobe disclosed CVE-2024-34102, a critical (CVSS 9.8) pre-authentication XML external entity (XXE) flaw in Adobe Commerce and Magento. The vulnerability lies in recursive REST API deserialization and can be reached through an unauthenticated guest-cart shipping-estimation endpoint, allowing attacker-controlled data to instantiate SimpleXMLElement objects and retrieve local or remote resources.
An attacker could use the flaw to read Magento's app/etc/env.php, exposing the installation's cryptographic key and potentially enabling forged administrator JWTs for privileged Magento API access. Research further indicates the issue could be chained with PHP filter techniques and CVE-2024-2961 toward remote code execution; organizations should apply Adobe's security update, as early third-party emergency mitigations were bypassable and later revised.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Adobe published a security advisory for CVE-2024-34102, a critical pre-authentication XML external entity injection vulnerability in Adobe Commerce and Magento. Adobe assigned the flaw a CVSS score of 9.8.
Researchers described exploiting recursive Magento REST API deserialization through an unauthenticated guest-cart shipping-estimation endpoint to exfiltrate files such as app/etc/env.php. They also reported that initial emergency mitigations from SanSec and Sergey Temnikov were bypassable before being revised.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
slcyber.io
Open sourcegithub.com
Open sourcehelpx.adobe.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability in the Magento ecommerce platform, identified as CVE-2025-54236 and dubbed 'SessionReaper,' has been actively exploited in the wild. The flaw allows attackers to hijack user sessions and achieve unauthenticated remote code execution (RCE) on affected Magento installations. Security researchers observed a surge in exploitation attempts following the public release of a proof-of-concept (PoC) exploit, with attackers deploying web shells and conducting reconnaissance using classic PHP probes. Adobe released an emergency patch for the vulnerability, and organizations are urged to apply it immediately to mitigate risk. Magento's widespread use and history of critical vulnerabilities make this flaw particularly attractive to threat actors. Exploitation attempts have targeted over 130 hosts from multiple IP addresses within 48 hours of the PoC's publication. Web application firewalls, such as Akamai's Adaptive Security Engine, have been effective in mitigating some exploit attempts by default. The vulnerability's critical nature and active exploitation highlight the urgent need for patching and enhanced monitoring of Magento deployments.
Jun 29, 2026
Adobe Commerce and Magento Community Edition deployments are exposed to **CVE-2025-54236**, a critical improper-input-validation flaw (CWE-20) that allows a remote, unauthenticated attacker to take over user sessions without interaction. Public exploit code, including the Metasploit `Magento SessionReaper` module, is available, increasing the risk of account compromise, unauthorized access to customer and business data, and malicious activity in affected online stores. Adobe released fixes for the vulnerability, and the Dutch National Cyber Security Centre urged organizations to apply the updates immediately and have providers confirm whether their installations are affected. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog; organizations should prioritize patching affected Adobe Commerce and Magento packages, validate remediation, and review sessions and store activity for signs of compromise.
Sep 3, 2026
Attackers have begun targeting **CVE-2026-71362**, a critical incorrect-authorization flaw in **Adobe Commerce**, **Adobe Commerce B2B**, and **Magento Open Source** that can let unauthenticated users hijack customer accounts. Sansec reported seeing exploitation attempts blocked by its Shield WAF and said patch analysis showed Magento mishandles customer identity within an account session, allowing a session to be switched to another customer account and exposing private customer data. Adobe included fixes for CVE-2026-71362 in its August 2026 security updates, with affected versions spanning multiple July 2026 and some August 2026 release lines before newer August builds. The same update also addressed **CVE-2026-48413**, a stored **XSS** issue, along with six additional Commerce and Commerce B2B vulnerabilities, four rated high severity. Administrators were urged to move to the latest supported `-p` release and apply Adobe’s isolated patches promptly to reduce the risk of account takeover and data exposure.
Aug 28, 2026