Over 250 Magento Stores Hit Overnight as Hackers Exploit New Adobe Commerce Flaw

Over 250 Magento stores were hit overnight as attackers exploit a recently disclosed Adobe Commerce and Magento Open Source flaw, according to Sansec. The vulnerability, CVE-2025-54236, a critical improper input validation flaw also known as SessionReaper, could be abused to take over customer accounts through the Commerce REST API, with more than 250 attack attempts recorded against multiple stores in the past 24 hours.

The flaw was addressed by Adobe last month, and a security researcher known as Blaklis is credited with its discovery and responsible disclosure. Sansec notes that 62% of Magento stores remain vulnerable six weeks after public disclosure, urging administrators to apply patches before exploitation broadens.

Attacks have originated from IP addresses including 34.227.25[.]4, 44.212.43[.]34, 54.205.171[.]35, 155.117.84.134 and 159.89.12[.]166, with threat actors leveraging the flaw to drop PHP webshells or probe for PHP configuration data, according to Sansec.