Vulnerability Description
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Adobe | Commerce | 2.4.4 |
| Adobe | Commerce B2B | 1.3.3 |
| Adobe | Magento | 2.4.5 |
Related Weaknesses (CWE)
References
- https://helpx.adobe.com/security/products/magento/apsb25-88.htmlVendor Advisory
- https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-27Vendor Advisory
- https://nullsecurityx.codes/cve-2025-54236-sessionreaper-unauthenticated-rce-in-Broken LinkExploitThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-US Government Resource
FAQ
What is CVE-2025-54236?
CVE-2025-54236 is a vulnerability with a CVSS score of 9.1 (CRITICAL). Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this t...
How severe is CVE-2025-54236?
CVE-2025-54236 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2025-54236?
Check the references section above for vendor advisories and patch information. Affected products include: Adobe Commerce, Adobe Commerce B2B, Adobe Magento.