Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.

Researchers have now observed exploitation attempts using this flaw, SessionReaper, to target Adobe Commerce stores. Patching is strongly advised.

Adobe released an out-of-band fix for 'SessionReaper' vulnerability that could lead to account takeover. Apply available patches. We are monitoring for further intel.

Adobe Magento Open Source / Commerce is prone to an unauthenticated Remote Code Execution vulnerability due to insecure deserialization of untrusted data. An attacker can exploit this issue to execute arbitrary code in the context of the web server process.

The version of Adobe Commerce B2B installed on the remote host it is, therefore, affected by a vulnerability as referenced in the APSB25-88 advisory.

  - Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are     affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve     session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this     issue does not require user interaction. (CVE-2025-54236)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Adobe Commerce/Magento Open Source installed on the remote host it is, therefore, affected by a vulnerability as referenced in the APSB25-88 advisory.

  - Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are     affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve     session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this     issue does not require user interaction. (CVE-2025-54236)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
115019	Adobe Commerce / Magento Insecure Deserialization (SessionReaper)	Web App Scanning	Component Vulnerability	critical
265751	Adobe Commerce B2B Improper Input Validation (APSB25-88)	Nessus	Misc.	critical
265750	Adobe Commerce/Magento Open Source Improper Input Validation (APSB25-88)	Nessus	Misc.	critical

Detections

Analytics

CVE-2025-54236

critical

Tenable Plugins

critical

critical

critical