In CISA KEV9.1 CriticalCWE-20
CVE-2025-54236
Adobe Commerce and Magento Improper Input Validation Vulnerability
AdobeCommerce and Magento
Status
- Exploited in the wild
- In CISA KEV since 24 Oct 2025
- Vendor fix available
Federal deadlineFri 14 Nov 2025, 23:59 UTC
Passed 344 days ago
CISA KEV · added 24 Oct 2025
Exploit probabilityEPSSchecked 25 Oct
95%probability of exploitation in the next 30 days
Higher than 100% of scored CVEs
SeverityCVSS
9.1Critical
Description NVD
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage 1 article · 1 outlet
- “SessionReaper” Harvests Roots: Mass Exploitation Campaign Hits Over 200 Magento SitesSecurityOnline · first in our coverage