Fear the 'SessionReaper': Adobe Commerce Flaw Under Attack

CVE-2025-54236 is a critical input-validation flaw in Adobe Commerce (formerly Magento) that can allow attackers to remotely take over sessions on the platform, with exploitation disclosed on 9 Sept 2025 and an emergency update subsequently patching both Adobe Commerce and Magento open source versions. According to Sansec, exploitation activity began last Wednesday and more than 250 attack attempts were blocked against multiple stores by its Magento-focused Shield WAF.

Sansec’s advisory also notes that 38% of e-commerce platforms are patched more than a month after the flaw was first disclosed, and that exploitation activity appears to be increasing, with attack attempts now spanning 97 IP addresses. It's been stated that some payloads in attacks featured PHP web shells or phpinfo probes, prompting recommendations to deploy the emergency update and a WAF to monitor for signs of compromise.

Adobe confirmed that the flaw had been exploited in the wild, according to the updated advisory, and Sansec warned that the window for safe patching had effectively closed, urging immediate action for customers.