Secuno
ENNL
Book demo

CVE-2025-54236

Adobe Commerce and Magento Improper Input Validation

9.1 CRITICALActively exploited (CISA KEV)Public exploitEPSS 94.5%
  1. Published9 Sept 2025
  2. Added to CISA KEV24 Oct 2025
  3. Remediation due14 Nov 2025
Actively exploited (CISA KEV)

Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API.

Added to KEV: 24 Oct 2025Federal remediation due: 14 Nov 2025

Description

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityNone
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

Adobe Commerce2.4.4 · 2.4.5 · 2.4.6 · 2.4.7
Adobe Commerce B2b1.3.3 · 1.3.4 · 1.4.2 · 1.5.2
Adobe Magento2.4.5

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-843178.8
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1,…
CVE-2026-843168.8
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1,…
CVE-2026-571438.8
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62,…
CVE-2026-1034138.8
Improper input validation vulnerability in Apache Camel Karavan. When a deployment…
CVE-2026-764688.2
As part of Cisco's ongoing commitment to proactive security and product quality, the…
CVE-2026-764568.6
As part of Cisco's ongoing commitment to proactive security and product quality, the…

Frequently asked

Is CVE-2025-54236 being actively exploited?

Yes. CVE-2025-54236 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 24 Oct 2025.

How severe is CVE-2025-54236?

CVE-2025-54236 has a CVSS 3.1 base score of 9.1, rated critical. EPSS estimates a 94.5% probability of exploitation.

Which products are affected by CVE-2025-54236?

Affected products include Adobe Commerce, Adobe Commerce B2b, Adobe Magento.

How do I fix CVE-2025-54236?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-54236 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.