Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.

Researchers have now observed exploitation attempts using this flaw, SessionReaper, to target Adobe Commerce stores. Patching is strongly advised.

Adobe released an out-of-band fix for 'SessionReaper' vulnerability that could lead to account takeover. Apply available patches. We are monitoring for further intel.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are
    affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve
    session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue
    does not require user interaction. (CVE-2025-54236)

Adobe Magento Open Source / Commerce is prone to an unauthenticated Remote Code Execution vulnerability due to insecure deserialization of untrusted data. An attacker can exploit this issue to execute arbitrary code in the context of the web server process.

The version of Adobe Commerce B2B installed on the remote host it is, therefore, affected by a vulnerability as referenced in the APSB25-88 advisory.

  - Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are     affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve     session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this     issue does not require user interaction. (CVE-2025-54236)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Adobe Commerce/Magento Open Source installed on the remote host it is, therefore, affected by a vulnerability as referenced in the APSB25-88 advisory.

  - Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are     affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve     session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this     issue does not require user interaction. (CVE-2025-54236)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
446920	SCA: security update for magento/community-edition, magento/project-community-edition (GHSA-wh92-6q6g-px7j)	Tenable Cloud Security	SCA Checks	Local	critical
446920	SCA: security update for magento/community-edition, magento/project-community-edition (GHSA-wh92-6q6g-px7j)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
115019	Adobe Commerce / Magento Insecure Deserialization (SessionReaper)	Web App Scanning	Component Vulnerability	Check Based	critical
265751	Adobe Commerce B2B Improper Input Validation (APSB25-88)	Nessus	Misc.	Local	critical
265750	Adobe Commerce/Magento Open Source Improper Input Validation (APSB25-88)	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2025-54236

critical

Tenable Plugins

critical

critical

critical

critical

critical