Adobe Commerce Flaw CVE-2025-54236 Lets Hackers Take Over Customer Accounts

Adobe has warned of a critical flaw in its Commerce and Magento Open Source platforms, tracked as CVE-2025-54236 (aka SessionReaper), with a CVSS score of 9.1 and described as an improper input validation flaw that could let an attacker take over customer accounts through the Commerce REST API. According to Adobe, the vulnerability affects multiple product lines and versions, including Adobe Commerce (all deployment methods) and Magento Open Source, with specific version ranges detailed in its advisory.

The security firm Sansec says it reproduced one exploitation path and notes there are other possible attack vectors, while Adobe has released a hotfix and has deployed web application firewall rules to protect Magento Commerce environments on Cloud infrastructure. The advisory also states that Adobe is not aware of any exploits in the wild at present.

The vulnerability is described as severe and is being monitored closely by the security community, with researchers highlighting how a malicious session combined with a nested deserialization bug in Magento’s REST API could enable remote code execution.