U.S. CISA adds Microsoft WSUS, and Adobe Commerce and Magento Open Source flaws to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft WSUS and Adobe Commerce and Magento Open Source flaws to its Known Exploited Vulnerabilities catalog. The two vulnerabilities named are CVE-2025-54236, an Adobe Commerce and Magento Improper Input Validation Vulnerability, and CVE-2025-59287, a Microsoft Windows Server Update Service Deserialization of Untrusted Data Vulnerability.

The article notes that CVE-2025-54236 has a CVSS score of 9.1 and has been linked to demonstrations of account hijacking via the REST API, with Sansec reporting over 250 attacks in 24 hours. It also says CVE-2025-59287 has a CVSS score of 9.8 and enables code execution over a network through deserialization of untrusted data.

The piece adds that Adobe issued an emergency patch for the SessionReaper flaw last month, following responsible disclosure by Blaklis, and that attackers have used diverse payloads, including PHP webshells, against affected stores. CISA directs federal agencies to address these vulnerabilities by the due date and private organisations are urged to review the KEV catalog and protect their infrastructure.