SessionReaper Vulnerability Puts Magento & Adobe Commerce Sites in Hacker Crosshairs

Adobe has broken its regular patch schedule to address CVE-2025-54236, a critical vulnerability in Magento Commerce and open-source Magento installations, dubbed “SessionReaper.” The flaw allows attackers to bypass input validation in the Magento Web API, enabling automated account takeover, data theft, and fraudulent orders without valid session tokens.

An emergency fix is scheduled for Tuesday, 9 September at 14:00 UTC, over a month ahead of the planned October 14 update, and merchants are urged to prepare immediately to thwart exploitation. The vulnerability is considered among the most severe Magento flaws in history, with prior exploits such as Shoplift, Ambionics SQLi, TrojanOrder, and CosmicSting referenced as peers; each prior exploit led to thousands of stores being compromised within hours of disclosure, according to Sansec.

Adobe’s internal patch discussions began on 22 August and private notification to Commerce customers occurred by 4 September, while open‑source Magento users received no warning. Magento administrators should monitor the Magento Security Center and apply the official patch when released, with mitigations including compensating controls such as web application firewalls and strict JSON validation where appropriate.