Magento Community Edition Improper Input Validation vulnerability
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact to high. Exploitation of this issue does not require user interaction.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-54236US | —OT critical | KEV | ||
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attac… | ||||
02
references
External citations — patches, advisories, analysis.
- https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-27397WEB
- https://github.com/magento/magento2PACKAGE
- https://helpx.adobe.com/security/products/magento/apsb25-88.htmlWEB
- https://nullsecurityx.codes/cve-2025-54236-sessionreaper-unauthenticated-rce-in-magentoWEB
- https://nvd.nist.gov/vuln/detail/CVE-2025-54236ADVISORY
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54236WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan