{"id":"CVE-2025-54236","published":"2025-09-09T14:15:46Z","modified":"2026-06-17T09:39:41Z","title":"Adobe Commerce and Magento Improper Input Validation Vulnerability","vendor":"Adobe","product":"Commerce and Magento","tier":"core","eol":null,"description":{"text":"Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.","provenance":"source","from":"NVD"},"summary":{"text":"Adobe Commerce and Magento contain an improper input validation flaw. An attacker with network access can exploit it without authentication or user interaction to take over sessions and compromise confidentiality and integrity.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:10:07Z"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.95353,"percentile":0.99867,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2025-10-24","dueDate":"2025-11-14","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-27397 ; https://nvd.nist.gov/vuln/detail/CVE-2025-54236","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-10-21","exploitedFirstSeen":"2025-10-21","ransomware":false,"evidence":[{"url":"https://sansec.io/research/sessionreaper-exploitation","date":"2025-10-21"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-10-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-10-27&host_type=src&vulnerability=cve-2025-54236","date":"2025-10-27"},{"url":"https://research.checkpoint.com/2025/27th-october-threat-intelligence-report/","date":"2025-10-27"},{"url":"https://www.akamai.com/blog/security-research/2025/oct/grim-sessionreaper-cve-2025-54236-comes-collect-halloween","date":"2025-10-27"},{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-54236","date":"2025-11-05"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-11-13&host_type=src&vulnerability=cve-2025-54236","date":"2025-11-13"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-11-14&host_type=src&vulnerability=cve-2025-54236","date":"2025-11-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-11-15&host_type=src&vulnerability=cve-2025-54236","date":"2025-11-15"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-11-21&host_type=src&vulnerability=cve-2025-54236","date":"2025-11-21"}],"evidenceTotal":162,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"deepveindrilling.com: Magento CMS block loader hits 953 stores","url":"https://otx.alienvault.com/pulse/6ae250b362165e0f75808fa3","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Hackers Infect 953 Online Stores With Malicious JavaScript That Evades Security Scanners","url":"https://otx.alienvault.com/pulse/6ae0671b49ae6aa9242d1e69","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"deepveindrilling.com: Magento CMS block loader hits 953 stores","url":"https://otx.alienvault.com/pulse/6add9cbb9d565685946f59b0","created":"2026-10-25"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"}],"provenance":"machine"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"https://helpx.adobe.com/security/products/magento/apsb25-88.html","tags":["Vendor Advisory"]},{"url":"https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-27397","tags":["Vendor Advisory"]},{"url":"https://nullsecurityx.codes/cve-2025-54236-sessionreaper-unauthenticated-rce-in-magento","tags":["Broken Link","Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54236","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Public-facing e-commerce app exploited remotely without authentication","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability","start":0,"end":160}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1550","name":"Use Alternate Authentication Material","tactics":["lateral-movement"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Session takeover enables reuse of hijacked session tokens","mappingType":"primary_impact","evidence":[{"from":"description","quote":"A successful attacker can abuse this to achieve session takeover","start":162,"end":226}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[{"ecosystem":"Packagist","package":"magento/community-edition","vulnerableRanges":["<=2.4.5-p14",">=2.4.6-p1, <=2.4.6-p12",">=2.4.9-alpha1, <=2.4.9-alpha2",">=2.4.7-beta1, <=2.4.7-p7",">=2.4.8-beta1, <=2.4.8-p2"],"patched":[],"from":["GHSA-wh92-6q6g-px7j"],"provenance":"source"},{"ecosystem":"Packagist","package":"magento/project-community-edition","vulnerableRanges":["<=2.0.2"],"patched":[],"from":["GHSA-wh92-6q6g-px7j"],"provenance":"source"}],"advisories":[{"id":"GHSA-wh92-6q6g-px7j","url":"https://github.com/advisories/GHSA-wh92-6q6g-px7j","severity":"CRITICAL","ecosystem":"Packagist","package":"magento/community-edition","vulnerableRanges":["<=2.4.5-p14"],"patched":[],"provenance":"source","from":"GHSA"},{"id":"GHSA-wh92-6q6g-px7j","url":"https://github.com/advisories/GHSA-wh92-6q6g-px7j","severity":"CRITICAL","ecosystem":"Packagist","package":"magento/community-edition","vulnerableRanges":[],"patched":[],"provenance":"source","from":"GHSA"},{"id":"GHSA-wh92-6q6g-px7j","url":"https://github.com/advisories/GHSA-wh92-6q6g-px7j","severity":"CRITICAL","ecosystem":"Packagist","package":"magento/community-edition","vulnerableRanges":[">=2.4.6-p1, <=2.4.6-p12"],"patched":[],"provenance":"source","from":"GHSA"},{"id":"GHSA-wh92-6q6g-px7j","url":"https://github.com/advisories/GHSA-wh92-6q6g-px7j","severity":"CRITICAL","ecosystem":"Packagist","package":"magento/community-edition","vulnerableRanges":[],"patched":[],"provenance":"source","from":"GHSA"},{"id":"GHSA-wh92-6q6g-px7j","url":"https://github.com/advisories/GHSA-wh92-6q6g-px7j","severity":"CRITICAL","ecosystem":"Packagist","package":"magento/community-edition","vulnerableRanges":[">=2.4.9-alpha1, <=2.4.9-alpha2"],"patched":[],"provenance":"source","from":"GHSA"},{"id":"GHSA-wh92-6q6g-px7j","url":"https://github.com/advisories/GHSA-wh92-6q6g-px7j","severity":"CRITICAL","ecosystem":"Packagist","package":"magento/community-edition","vulnerableRanges":[],"patched":[],"provenance":"source","from":"GHSA"},{"id":"GHSA-wh92-6q6g-px7j","url":"https://github.com/advisories/GHSA-wh92-6q6g-px7j","severity":"CRITICAL","ecosystem":"Packagist","package":"magento/community-edition","vulnerableRanges":[],"patched":[],"provenance":"source","from":"GHSA"},{"id":"GHSA-wh92-6q6g-px7j","url":"https://github.com/advisories/GHSA-wh92-6q6g-px7j","severity":"CRITICAL","ecosystem":"Packagist","package":"magento/community-edition","vulnerableRanges":[">=2.4.7-beta1, <=2.4.7-p7"],"patched":[],"provenance":"source","from":"GHSA"},{"id":"GHSA-wh92-6q6g-px7j","url":"https://github.com/advisories/GHSA-wh92-6q6g-px7j","severity":"CRITICAL","ecosystem":"Packagist","package":"magento/community-edition","vulnerableRanges":[">=2.4.8-beta1, <=2.4.8-p2"],"patched":[],"provenance":"source","from":"GHSA"},{"id":"GHSA-wh92-6q6g-px7j","url":"https://github.com/advisories/GHSA-wh92-6q6g-px7j","severity":"CRITICAL","ecosystem":"Packagist","package":"magento/community-edition","vulnerableRanges":[],"patched":[],"provenance":"source","from":"GHSA"},{"id":"GHSA-wh92-6q6g-px7j","url":"https://github.com/advisories/GHSA-wh92-6q6g-px7j","severity":"CRITICAL","ecosystem":"Packagist","package":"magento/project-community-edition","vulnerableRanges":["<=2.0.2"],"patched":[],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2025-27277","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-27277","exploited":true,"exploitedSince":"2025-10-24","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":7,"skipped":0,"earliest":"2025-09-10","earliestUrl":"https://github.com/amalpvatayam67/day01-sessionreaper-lab","repos":[{"name":"wubinworks/magento2-session-reaper-patch","url":"https://github.com/wubinworks/magento2-session-reaper-patch","stars":4,"created":"2025-10-19"},{"name":"alexb616/SessionReaper-CVE-2025-54236","url":"https://github.com/alexb616/SessionReaper-CVE-2025-54236","stars":1,"created":"2026-03-19"},{"name":"amalpvatayam67/day01-sessionreaper-lab","url":"https://github.com/amalpvatayam67/day01-sessionreaper-lab","stars":0,"created":"2025-09-10"},{"name":"Baba01hacker666/cve-2025-54236","url":"https://github.com/Baba01hacker666/cve-2025-54236","stars":0,"created":"2025-12-30"},{"name":"Jenderal92/magento-upload-auto-submit-zoneh","url":"https://github.com/Jenderal92/magento-upload-auto-submit-zoneh","stars":0,"created":"2026-05-13"}]},"metasploit":[{"name":"Magento SessionReaper","module":"exploit/multi/http/magento_sessionreaper","type":"exploit","disclosureDate":"2025-10-22","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/magento_sessionreaper.rb"}],"nuclei":[{"id":"CVE-2025-54236","name":"Adobe Commerce - Authentication Bypass","severity":"critical","path":"http/cves/2025/CVE-2025-54236.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-54236.yaml"}],"first":{"date":"2025-09-10","source":"PoC-in-GitHub","url":"https://github.com/amalpvatayam67/day01-sessionreaper-lab"},"provenance":"source"},"exploitRefs":["https://nullsecurityx.codes/cve-2025-54236-sessionreaper-unauthenticated-rce-in-magento"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1550"],"provenance":"ai"}],"timeline":[{"date":"2025-09-09","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54236","provenance":"source"},{"date":"2025-09-10","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2025-10-22","url":"https://github.com/amalpvatayam67/day01-sessionreaper-lab","provenance":"source"},{"date":"2025-10-21","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://sansec.io/research/sessionreaper-exploitation","provenance":"source"},{"date":"2025-10-24","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-10-24","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-27277","provenance":"source"}],"speed":{"daysToPublicExploit":1,"firstExploitFrom":"PoC-in-GitHub","daysToKev":45},"priority":{"score":69.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 375 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9987"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 7 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}