Loading story…
SessionReaper (CVE-2025-54236) is a critical deserialization vulnerability in Magento 2 and Adobe Commerce that enables unauthenticated customer-account takeover through the Commerce REST API and, in certain configurations, remote code execution. Researchers described an attack chain combining manipulated API inputs with an unauthenticated file-upload endpoint, with file-based session storage particularly exposed. Redis-backed sessions are not affected by that specific chain, but alternative exploitation paths may exist. CrowdSec recorded 1,376 exploitation signals across 20 tracked days between October 28 and November 23, 2025, with a daily peak of 388 signals and up to 89 distinct attacking sources. Its reference to more than 130,000 stores reflects the platforms’ global footprint, not a verified count of compromised stores.
Adobe released an emergency fix on September 9, 2025, under security bulletin APSB25-88, including hotfix VULN-32437-2-4-X-patch. Adobe’s statement that it had no evidence of exploitation was explicitly dated September 18, 2025, preceding CrowdSec’s later observations; CrowdSec also reported the vulnerability’s subsequent addition to CISA’s Known Exploited Vulnerabilities catalog. Adobe deployed protective web application firewall rules for Commerce on Cloud infrastructure but emphasized that customers must still complete remediation. Organizations should prioritize applying Adobe’s applicable fixes, review session-storage configurations, and investigate suspicious REST API activity, uploads, and customer-account access. Researchers found that the patch restricts deserializable types, while warning that future changes could reintroduce similar weaknesses.
See which actors are running it and whether you're in range.
9 events from the most recent confirmed update back to the earliest known activity.
CrowdSec identified November 7 as the date it confirmed its first in-the-wild SessionReaper signals. Its report separately gives conflicting October 23 and October 28 dates for the beginning of exploitation activity.
CrowdSec released detection rules for exploitation attempts targeting CVE-2025-54236.
According to CrowdSec, CISA added CVE-2025-54236 to its Known Exploited Vulnerabilities catalog, requiring remediation under Binding Operational Directive 22-01.
Searchlight Cyber published a technical analysis showing how nested deserialization could be chained with an unauthenticated file-upload endpoint to achieve code execution on systems using file-based session storage. The analysis also described a response-code difference that could distinguish patched from unpatched systems.
In an updated security notice, Adobe stated that it had no evidence of CVE-2025-54236 being exploited in the wild and urged customers to apply the available hotfix.
Adobe publicly disclosed the vulnerability through security bulletin APSB25-88 and released an emergency patch. The hotfix restricts deserialization to simple types and specific API Data Objects.
CrowdSec reported 1,376 exploitation signals across 20 tracked days within October 28–November 23, 2025, with a daily peak of 388 signals and up to 89 distinct attacking sources. These figures describe observed activity, not a verified count of compromised stores.
Adobe deployed web application firewall rules to help protect Adobe Commerce on Cloud infrastructure against exploitation. It emphasized that merchants still needed to apply the hotfix and follow all remediation guidance.
Researcher Daniel “Blaklis” Le Gall discovered CVE-2025-54236 in Magento and Adobe Commerce. The flaw involves nested deserialization and can enable customer-account takeover and, in certain configurations, unauthenticated remote code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
pentest-tools.com
Open sourceexperienceleague.adobe.com
Open sourcecrowdsec.net
Open sourceslcyber.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Adobe Commerce and Magento Community Edition deployments are exposed to **CVE-2025-54236**, a critical improper-input-validation flaw (CWE-20) that allows a remote, unauthenticated attacker to take over user sessions without interaction. Public exploit code, including the Metasploit `Magento SessionReaper` module, is available, increasing the risk of account compromise, unauthorized access to customer and business data, and malicious activity in affected online stores. Adobe released fixes for the vulnerability, and the Dutch National Cyber Security Centre urged organizations to apply the updates immediately and have providers confirm whether their installations are affected. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog; organizations should prioritize patching affected Adobe Commerce and Magento packages, validate remediation, and review sessions and store activity for signs of compromise.
Sep 3, 2026
Hackers have begun actively exploiting the critical SessionReaper vulnerability (CVE-2025-54236) in Adobe Commerce (Magento) platforms, with security firm Sansec detecting and blocking hundreds of real-world attack attempts. The flaw, which allows attackers to take control of account sessions via the Commerce REST API, remains unpatched in approximately 62% of Magento stores, leaving thousands of e-commerce sites exposed to remote code execution and account takeover attacks. Technical analyses and proof-of-concept exploit code have been published, further increasing the risk of mass exploitation. Adobe issued an emergency patch for SessionReaper six weeks prior to the observed attacks, but patch adoption has been slow. Attackers are leveraging PHP webshells and probes to exploit the vulnerability, with most attacks originating from a handful of IP addresses. Security experts warn that the public availability of exploit details and the high impact of the flaw make rapid patching and the activation of web application firewalls critical for all affected organizations.
Jun 29, 2026
Adobe released an out-of-band fix for **CVE-2025-54236**, a critical improper input validation flaw in **Adobe Commerce**, **Adobe Commerce B2B**, and **Magento Open Source** that allows unauthenticated attackers to take over user sessions through vulnerable session-handling and Web API components. The bug, dubbed **"SessionReaper"** by Sansec, carries a reported **CVSS 9.1** rating and can lead to account hijacking, exposure of customer data, fraudulent orders, administrative access, and in some scenarios potentially remote code execution. Affected releases span multiple 2.4.x branches, including versions from **2.4.4 through 2.4.7** and other listed builds and earlier releases. Security guidance escalated after reports said the flaw was being actively exploited in the wild and added to **CISA's Known Exploited Vulnerabilities** catalog. Adobe published remediation details in **APSB25-88** and shipped patched versions, while defenders were urged to apply the vendor fix immediately, verify patch status, review logs for anomalous session activity, tighten administrative access, and increase **WAF**, API, and **SIEM** monitoring. Advisories also warned that leaked hotfix details and unofficial fixes could accelerate attacker weaponization or create additional risk.
Jun 29, 2026