Adobe product

Commerce and Magento

← All Adobe products

No CISA KEV deadline is open. CISA last added a Commerce and Magento CVE on 24 Sep.

Tracked since 30 Jan · latest article Mon 26 Oct · RSS

Open KEV deadlines: 0; None open
Added to KEV · 90 days: 2; of 3 in the full CISA catalogue · all time
High exploit odds · current: 0; EPSS top 5%, not in KEV
Articles · 7 days: 1; usual rate

Exploited, by due date

CSV download

CVEProductAddedDue · federal deadline

Deadlines passed

CVE-2026-71362Commerce and Magento24 SepDeadline passed 27 Sep6 articles

CVE-2026-75650Commerce and Magento8 SepDeadline passed 11 Sep8 articles

CVE-2025-54236Commerce and Magento24 Oct 2025Deadline passed 14 Nov 20252 articles

Coverage

2 articles · all timeFull timeline

Two articles so far, 30 Jan to 26 Oct.

1 2

Fri 30 Jan · first report“SessionReaper” Harvests Roots: Mass Exploitation Campaign Hits Over 200 Magento SitesSecurityOnline
Mon 26 OctSansec links malware campaign to 953 infected online storesSecurityWeek

All CVEs in coverage

CVE-2025-54236Adobe Commerce and Magento Improper Input Validation VulnerabilityCVSS9.1CriticalExploited95%EPSS2articles

How these numbers are made

CISA KEV counts use the full catalogue, refreshed every 10 minutes. CVEs in coverage are those recorded by CyberSIXT. BOD 22-01 deadlines bind US federal civilian agencies.

CVEs with FIRST EPSS at or above the 95th percentile (top 5%), excluding CVEs in CISA KEV. EPSS estimates exploitation probability over the next 30 days.

Coverage is above its usual rate at three or more articles in 7 days and at least 2.5 times the weekly mean of the preceding 8 weeks.

Product names are grouped by normalised names, with version and edition tails removed.

Fix listed refers to an advisory. Unknown fix status is counted as not listed.

Commerce and Magento

Exploited, by due date

Coverage

All CVEs in coverage

On this device

Intel

Settings

Keyboard shortcuts