CVE-2025-54236

Adobe Commerce | Improper Input Validation (CWE-20)

State: Published
Severity: 9.1 Critical
Published: Sep 9, 2025
Updated: Oct 24, 2025
Reserved: Jul 17, 2025

Description

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	adobe

Weaknesses

CWE-20 Improper Input Validation (CWE-20)

Affected Products

Product	Versions
Adobe CommerceAdobe	2.4.4-p15 and earlierAffected

References

https://helpx.adobe.com/security/products/magento/apsb25-88.htmlvendor-advisory
https://nullsecurityx.codes/cve-2025-54236-sessionreaper-unauthenticated-rce-in-magentoexploit
https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-27397mitigation
CISA KEVgovernment-resource

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.