Exploitation of Critical Adobe Commerce Flaw Puts Many eCommerce Sites at Risk

According to Sansec, hackers have started exploiting a critical Adobe Commerce and Magento Open Source flaw tracked as CVE-2025-54236 (CVSS 9.1), an improper input validation issue that can bypass a security feature. Adobe released hotfixes on 9 September for Commerce and Magento Open Source versions 2.4.4 to 2.4.7 and later confirmed in an advisory that CVE-2025-54236 is being exploited in the wild.

Sansec says active exploitation has begun, with roughly 250 attacks observed on Wednesday, and the identified payloads included PHP webshells and phpinfo probes. The firm notes that less than half of ecommerce sites have been patched, meaning that 62% remain at risk, as 38% have applied Adobe’s hotfix. The weaponisation was foreshadowed when patch details leaked ahead of the hotfix, and the exploitation activity is expected to surge as technical writeups circulate.

Adobe’s update reiterates that the security defect’s in-the-wild exploitation is ongoing, underscoring the likelihood of continued mass exploitation within the near term.