CVE-2025-54236

criticalpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.947 · 100 %ileexploit · weaponizedDEEUNLRUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 8 exploits · weaponized

Likely / severe?

94.7% (100th) EPSS

CVSS 9.1 · critical

Is it mine?

33 products

Check your exposure

Who says so?

7 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

added 2025-10-24remediate by 2025-11-14

required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

EPSS · scored 2026-10-23

Adobe Commerce and Magento Improper Input Validation Vulnerability

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.

cvss

Technical severity, 0–10. One row per scoring source.

9.1

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.1criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · FSTEC (BDU) RU

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · ENISA EU

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · psirt@adobe.comexploitability 3.9 · impact 5.2

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · OSV

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:Hsecondary · CVSS-BT (t0sche)

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-119USCWE-20USCWE-20USCWE-20US

exploits (8)

Public proof-of-concept and weaponised exploit code.

exploit/multi/http/magento_sessionreaperMagento SessionReaperweaponized · metasploit
Baba01hacker666/cve-2025-54236cve-2025-54236 poc PoC · poc_in_github
Dx3iZ/CVE-2025-54236Adobe Magento SessionReaper LFI VulnerabilityPoC · poc_in_github
Jenderal92/magento-upload-auto-submit-zonehSessionReaper-CVE-2025-54236PoC · poc_in_github
alexb616/SessionReaper-CVE-2025-54236PoC Magento Session Reaper - CVE-2025-54236PoC · poc_in_github
amalpvatayam67/day01-sessionreaper-labThis is a tiny lab that simulates the core idea reported for CVE-2025-54236 (“SessionReaper”)PoC · poc_in_github

affected products (33)

Products and version ranges known to be affected.

Adobe Magentoall versionscert_bundDEcpe:/a:adobe:magento:-
Adobe Magento <Hotfix for CVE-2025-54236all versionscert_bundDE
Adobe Magento< Hotfix for CVE-2025-54236cert_bundDE
Adobe Adobe Commerce≤ 0 ≤2.4.4-p15enisa_euvdEU
Siemens AG SIMATIC PCS neo≤ 4.1fstec_bduRU
Siemens AG SIMATIC PCS neo≤ 5.0fstec_bduRU
Siemens AG User Management Component (UMC)≤ 2.15.1.3fstec_bduRU
Adobe Adobe Commerce≤ vers:unknown/*ncsc_nlNL
Adobe Adobe Commerce B2B≤ vers:unknown/*ncsc_nlNL
Adobe Magento Open Source≤ vers:unknown/*ncsc_nlNL
adobe commerce= 2.4.4nvdUScpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*
adobe commerce= 2.4.5nvdUScpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*
adobe commerce= 2.4.6nvdUScpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*
adobe commerce= 2.4.7nvdUScpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*
adobe commerce= 2.4.8nvdUScpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*
adobe commerce= 2.4.9nvdUScpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*
adobe commerce b2b= 1.3.3nvdUScpe:2.3:a:adobe:commerce_b2b:*:*:*:*:*:*:*:*
adobe commerce b2b= 1.3.4nvdUScpe:2.3:a:adobe:commerce_b2b:*:*:*:*:*:*:*:*
adobe commerce b2b= 1.4.2nvdUScpe:2.3:a:adobe:commerce_b2b:*:*:*:*:*:*:*:*
adobe commerce b2b= 1.5.2nvdUScpe:2.3:a:adobe:commerce_b2b:*:*:*:*:*:*:*:*

showing 20 of 33

advisories (3)

Vendor and ecosystem advisories describing this.

NCSC-2025-0284Kwetsbaarheid verholpen in Adobe Commerce en MagentoNL2025-09-10csaf · ncsc_nlNL
Adobe heeft een kwetsbaarheid verholpen in Adobe Commerce en Magento.
WID-SEC-W-2025-1999Adobe Magento SessionReaper: Schwachstelle ermöglicht Umgehung von SicherheitsmaßnahmenDeutsch2025-09-08csaf · cert_bundDE
Ein Angreifer kann eine Schwachstelle in Adobe Magento ausnutzen, um Sicherheitsmaßnahmen zu umgehen.
GHSA-wh92-6q6g-px7jMagento Community Edition Improper Input Validation vulnerability2025-09-09ghsa · osvUS
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact to high. Exploitation of this issue does not require user interaction.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund ncsc_nl nvd osv NVD CVE.org MITRE

published 2025-09-09modified 2026-06-17

references (7)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan