by Kastro
Paper/Archive/CVE-2025-54236

CVE-2025-54236

Adobe Adobe Commerce — Adobe Commerce | Improper Input Validation (CWE-20)

KEV · due 14 NovEPSS 95%public exploitSSVC actCVSS 9.1
critical.is priorityof 100
97
CVSS 9.1 (CNA)9.1 / 10 × 3027.3In CISA KEV+3030.0EPSS percentile 99.9.999 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.

Affected

ProductAffectedFixed inSource
Adobe Commerce≤ 2.4.4-p15–CNA

Scores by source

adobe (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

advisoryhelpx.adobe.com/security/products/magento/apsb25-88.htmlexploitnullsecurityx.codes/cve-2025-54236-sessionreaper-unauthenticated-rce-in-magentorefexperienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-27397refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54236kevcisa.gov/known-exploited-vulnerabilities-catalog