Latest Adobe Commerce & Magento vulnerability #
Adobe has disclosed an improper input validation vulnerability in the Commerce REST API, affecting certain versions of Adobe Commerce and Magento Open Source. Successful exploitation could allow a remote, unauthenticated adversary to take over another user's session. This vulnerability has been designated CVE-2025-54236 and has been rated critical with a CVSS score of 9.1.
Adobe's advisory describes the impact as a "security feature bypass" that could allow an adversary to take over users' accounts but does not mention additional risks such as remote code execution (RCE). However, the vulnerability researcher, Blaklis, posted that the security update patches "a pre-auth RCE and a customer ATO [account takeover]." Any RCE aspect of this vulnerability remains unconfirmed.
The following versions are affected
- Adobe Commerce versions prior to and including 2.4.4-p15
- Adobe Commerce versions prior to and including 2.4.5-p14
- Adobe Commerce versions prior to and including 2.4.6-p12
- Adobe Commerce versions prior to and including 2.4.7-p7
- Adobe Commerce versions prior to and including 2.4.8-p2
- Adobe Commerce versions prior to and including 2.4.9-alpha2
- Adobe Commerce B2B versions prior to and including 1.3.3-p15
- Adobe Commerce B2B versions prior to and including 1.3.4-p14
- Adobe Commerce B2B versions prior to and including 1.4.2-p7
- Adobe Commerce B2B versions prior to and including 1.5.2-p2
- Adobe Commerce B2B versions prior to and including 1.5.3-alpha2
- Magento Open Source versions prior to and including 2.4.5-p14
- Magento Open Source versions prior to and including 2.4.6-p12
- Magento Open Source versions prior to and including 2.4.7-p7
- Magento Open Source versions prior to and including 2.4.8-p2
- Magento Open Source versions prior to and including 2.4.9-alpha2
What is the impact? #
Successful exploitation of the vulnerability would allow an adversary to take over another user's session, gaining control of their account.
Are updates or workarounds available? #
Users are encouraged to apply the VULN-32437-2-4-X-patch hotfix or upgrade to the latest security patch for all Adobe Commerce and Magento Open Source versions as quickly as possible.
How to find potentially vulnerable systems with runZero #
From the Software Inventory, use the following query to locate potentially impacted assets:
vendor:=Adobe AND product:=Magento AND (version:>0 AND version:<="2.4.9-alpha2")
