CVE-2025-54236
Published: 09 September 2025
Summary
CVE-2025-54236 is a critical-severity Improper Input Validation (CWE-20) vulnerability in Adobe Commerce. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 1.4% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly enforces information input validation mechanisms to mitigate the improper input validation vulnerability enabling unauthenticated session takeover.
Mandates identification, reporting, and correction of system flaws like this CVE through timely patching as recommended by Adobe and CISA.
Requires vulnerability scanning to detect and prioritize remediation of this specific CVE in vulnerable Adobe Commerce versions before exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated exploitation of public-facing Adobe Commerce web app (T1190) resulting in session takeover/impersonation of valid user accounts (T1078).
NVD Description
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this…
more
issue does not require user interaction.
Deeper analysisAI
CVE-2025-54236 is an Improper Input Validation vulnerability (CWE-20) affecting Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15, and earlier. Published on 2025-09-09, it carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), highlighting its critical severity due to high impacts on confidentiality and integrity.
An unauthenticated attacker with network access can exploit this vulnerability with low attack complexity and no user interaction required. Successful exploitation enables session takeover, allowing the attacker to impersonate legitimate users and compromise sensitive data or perform unauthorized actions on the affected Adobe Commerce instance.
Adobe's security advisory APSB25-88 details the issue and recommends applying available patches to mitigate it, with further guidance in the Experience League knowledge base article KA-27397. The vulnerability is also listed in the CISA Known Exploited Vulnerabilities Catalog.
A third-party analysis on nullsecurityx.codes describes it as enabling unauthenticated remote code execution under the name "SessionReaper," though official sources emphasize session takeover as the primary impact. Its inclusion in CISA's catalog confirms real-world exploitation.
Details
- CWE(s)
- KEV Date Added
- 24 October 2025