CVE-2025-54236
Adobe Commerce and Magento Improper Input Validation Vulnerability
Published Sep 9, 2025 · updated Jun 17, 2026 · Adobe Commerce and Magento
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.
Timeline
Detection, updates, and resolution for this record.
Sep 9, 2025 · Catalog
Detected
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.
Oct 24, 2025 · CISA KEV
Known exploited
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Nov 14, 2025 · CISA KEV
Remediation due
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Jun 17, 2026 · Catalog
Updated
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date Nov 14, 2025
Affected
- cpe adobe/commerce2.4.4
- cpe adobe/commerce b2b1.3.3
- cpe adobe/magento2.4.5
- vendor Adobe Commerce and Magentoversion unspecified
Sources
- CISA KEVCVE-2025-54236
Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API.
cisa.gov - CVE.orgCVE-2025-54236
Official CVE identifier
cve.org - FIRST EPSSCVE-2025-54236
30-day exploitation probability 94.5%
first.org - Metasploit Modulesexploit_multi/http/magento_sessionreaper
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2025-54236
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact
nvd.nist.gov