Active Exploits Target Magento and Adobe Commerce RCE, Attackers Inject Webshells

Unauthenticated attackers are actively exploiting a critical vulnerability affecting Adobe Commerce and Magento platforms worldwide, tracked as CVE-2025-54236 and dubbed SessionReaper. The flaw enables remote code execution and customer account takeover and was first observed in mass attacks on October 22, 2025, according to Sansec, with less than 40 percent of affected stores having deployed protective fixes at that time.

SessionReaper combines a malicious session with a nested deserialization bug in Magento’s REST API to grant attackers full control over vulnerable storefronts, with exploits arriving via the /customer/address_file/upload endpoint and concealing PHP backdoors as fake session files.

Adobe released the SessionReaper patch on 9 September as an out-of-band emergency update, but adoption remained slow, and by mid-September fewer than one in three Magento stores had installed the fix; the patch code was even leaked on GitHub, potentially accelerating attacker preparations.

Security guidance urges applying the official patch or temporarily mounting a WAF, and for stores already patched to run malware scanners and rotate cryptographic keys, with about 62 percent of stores still unpatched as exploitation campaigns continue.