Adobe Issues Emergency Patch for SessionReaper (CVE-2025-54236), One of Magento’s Most Critical Flaws

Adobe has issued an emergency patch for CVE-2025-54236, known as SessionReaper, describing it as one of Magento’s most severe flaws. The fix was released ahead of Adobe’s regular schedule after Sansec flagged that automated abuse could target thousands of online stores within hours of disclosure, with the patch expected at 14:00 UTC on 9 September 2025; Adobe had planned a 14 October date.

SessionReaper targets Magento’s WebAPI ServiceInputProcessor and can be exploited to hijack user sessions or manipulate sensitive data, potentially enabling large-scale credit card theft, account takeover, or administrative access. According to Sansec, automated exploitation tools are likely to appear rapidly, and merchants should act immediately; a leaked concept patch circulating as MCLOUD-14016 is unverified regarding stability and completeness.

For now, merchants are advised to apply the emergency patch as soon as it is released, or, if patching is not possible, to disable or secure actuator endpoints and monitor logs for suspicious activity, with Sansec Shield cited as already mitigating this attack vector.