Critical Magento Flaw (CVE-2025-54236) Actively Exploited for Session Hijacking and Unauthenticated RCE

According to Akamai researchers, a critical Magento vulnerability known as SessionReaper (CVE-2025-54236) is being actively exploited in the wild to hijack user sessions and, in some conditions, achieve unauthenticated remote code execution. Akamai’s warning notes that over a 48-hour period starting on 22 October 2025, more than 300 exploitation attempts were observed against over 130 different hosts, emanating from 11 different IPs.

The flaw affects Magento, now integrated under Adobe Commerce, and was first disclosed in an Adobe emergency patch bulletin on 9 September 2025, with a public PoC soon surfacing and triggering widespread automated scanning. Exploitation involves an improper input validation vulnerability in Magento’s session-handling logic, enabling attackers to chain the flaw to run arbitrary PHP code on unpatched servers.

Akamai urges immediate patching, emphasising the combination of Magento’s ubiquity and the vulnerability’s ease of exploitation as a compelling reason for organisations to apply the Adobe fixes as soon as possible.