CVE-2025-54236Active Exploitation(adobe / commerce)

HIGHCVSS 9.1 · CRITICALCISA KEV

Exploitation observed; activity peaked at 5 mentions and remains active

Immediate actions

Patch adobe commerce systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.

adobe CVEs Back to dashboard

6.0/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2025-11-14. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Exploit / PoC references

https://nullsecurityx.codes/cve-2025-54236-sessionreaper-unauthenticated-rce-in-magento

Vendor / third-party advisories

Other references

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54236

Weakness type (CWE)

CWE-20

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

commerce
commerce_b2b
magento

Threat summary

Active exploitation appears in 17 classified signals
Public PoC is present in monitored signal
Patch or workaround signal is available
29 mentions across 17 observed days

What's happening

Active exploitation reported across 17 signals
PoC mentioned or linked in 4 signals
Patch or workaround mentioned in 6 signals
Technical details provided in 17 signals
General: 6 classified signals
Peaked 15d ago at 5 mentions (2026-01-30); latest day: 1
29 total mentions across 17 days

Affected systems

Vendors

adobe

Products

commercecommerce_b2bmagento

11 versions affected across 3 products

Deep dive

Activity timeline29 mentions / 17d

Signal classification5 categories

Active Exploitation

1758.6%

General

620.7%

PoC

310.3%

Patch

26.9%

Disclosure

13.4%

Referenced assets27 URLs

By indicator

Classification over time

Date	Total	Labels

2026-01-28	1	Active Exploitation1
2026-01-30	5	Active Exploitation5
2026-02-02	1	Active Exploitation1
2026-02-03	2	Active Exploitation2
2026-02-06	1	Active Exploitation1
2026-02-19	1	General1
2026-03-10	4	Active Exploitation2General1Patch1
2026-03-12	1	General1
2026-03-18	2	Active Exploitation1PoC1
2026-03-20	2	Active Exploitation2
2026-04-05	1	Patch1
2026-04-15	1	General1
2026-04-23	1	Disclosure1
2026-06-25	2	PoC2
2026-07-05	1	General1
2026-08-06	2	Active Exploitation1General1
2026-08-13	1	Active Exploitation1

Full discourse20 posts

Germán Fernández@1ZRR4H204d
Active Exploitation
→ POC: Magento Unauthenticated File Upload 🔥 🚨 Ataques masivos contra Magento explotan subida arbitraria de archivos vinculada a SessionReaper (CVE-2025-54236) / https://www.cronup.com/ataques-masivos-contra-magento-explotan-subida-arbitraria-de-archivos-vinculada-a-sessionreaper-cve-2025-54236/. + REF: https://x.com/1ZRR4H/status/2031134299185987599 https://t.co/DuSlIgoHFu
Post summary
The post announces a PoC for an unauthenticated file upload flaw in Magento, confirms mass exploitation in the wild, and provides a link to the detailed PoC.
229055217.2K
37.3K followersView on X
Ven0m@V3n0mStrike213d
Active Exploitation
Posible explotación masiva de CVE-2025-54236 (SessionReaper) en plataformas Magento / Adobe Commerce. Su impacto va más allá del secuestro de sesión: puede facilitar bypass de controles de seguridad y, en escenarios observados públicamente, incluso ejecución remota de código no autenticado. #Defacement #Ciberseguridad
Post summary
The message warns that CVE-2025-54236 is likely being exploited on Magento/Adobe Commerce platforms, with publicly observed instances of remote code execution beyond session hijacking.
115051166.2K
2.7K followersView on X
reverseame@reverseame231d
General
Why nested deserialization is STILL harmful – Magento RCE (CVE-2025-54236) https://slcyber.io/research-center/why-nested-deserialization-is-still-harmful-magento-rce-cve-2025-54236/
Post summary
The linked article discusses the nested deserialization vulnerability in Magento that leads to RCE, referencing CVE-2025-54236, but provides no PoC, exploit code, or patch details.
04017211.5K
21.6K followersView on X
Germán Fernández@1ZRR4H204d
PoC
@tial_cl @chum1ng0 Blog actualizado, ahora agregamos una POC (checker) que permite validar sitios web vulnerables 🔥 [+] https://www.cronup.com/ataques-masivos-contra-magento-explotan-subida-arbitraria-de-archivos-vinculada-a-sessionreaper-cve-2025-54236/ https://t.co/39t8mj5XJu
Post summary
The post announces a new PoC (checker) to validate sites vulnerable to CVE‑2025‑54236, with a link to the relevant blog, without mentioning patches, active exploitation, or detailed technical data.
1702572.6K
37.3K followersView on X
Shanholo@ShanHolo211d
General
CVE-2025-54236 #SessionReaper everywhere 🤷‍♂️ Web server Logs⤵️ POST /rest/V1/* POST /graphql POST /rest/V1/guest-carts/* https://t.co/rpEGGG3WWZ
Post summary
The tweet points out CVE‑2025‑54236 by showing sample POST requests, but it offers no proof of exploitation, code, patch, or detailed technical information.
140541.0K
2.0K followersView on X
Grok@grok213d
Active Exploitation
Este ataque explota la vulnerabilidad CVE-2025-54236 (SessionReaper) en Magento/Adobe Commerce. Permite subir archivos sin autenticación vía /customer/address_file/upload, que se guardan en /media/customer_address/. Los hackers subieron TXT con mensajes de defacement ("Hacked by L4663R666H05T x ... & Typical Idiot Security") en sitios chilenos como Entel, Bice Vida, Colun, CasaIdeas, etc. Por ahora solo defacean, pero el bug permite webshells y RCE. Actualiza ya si usas Magento.
Post summary
The post reports real-world attacks exploiting CVE-2025-54236 in Magento/Adobe Commerce, with attackers defacing sites and the vulnerability enabling webshells/RCE, alongside a call for users to promptly update.
100642.3K
8.4M followersView on X
AnkaRedTeam@ankaredofficial106d
PoC
🔴SessionReaper is one of the most dangerous Magento vulnerabilities disclosed in recent years. Here's how to exploit the vulnerability and prepare a PoC (Proof of Concept): Full write-up: https://www.turkhackteam.org/konular/adobe-magento-sessionreaper-lfi-zafiyeti-cve-2025-54236.2083477 #AnkaTeam #TurkHackTeam #Hack #Deface #TurkishHacker https://t.co/GbUbJ72Y73
Post summary
The tweet points to a write‑up that includes a Proof of Concept for the Magento SessionReaper vulnerability (CVE‑2025‑54236). The post does not provide an exploit script, active exploitation, patch, or technical details within the text itself.
10040101
37 followersView on X
Adam@seoscottsdale56d
Active Exploitation
🚨 Last 24h is HOT — primary sources only CISA added 3 KEVs on 11 Aug (all actively exploited): • CVE-2026-20349 — Cisco ASA/FTD unauth SSL VPN DoS Official: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF Fed deadline: 14 Aug. No workarounds. Hotfix now. • CVE-2026-68820 — Windows afd.sys LPE (SYSTEM) Microsoft: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68820 Lazarus (Operation Dream Job) weaponizing it since early July against defense targets. Patch + reboot. • CVE-2026-72898 — Metabase unauth SQLi → admin takeover https://www.metabase.com/blog/security-update https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf Already hit Framework, Tally, n8n. Block /api/session/reset_password or upgrade immediately. Fed deadline 14 Aug. Also tracking: Adobe Commerce session hijacks (CVE-2025-54236 SessionReaper + fresh CVE-2026-71362) SentinelOne: https://www.sentinelone.com/vulnerability-database/cve-2025-54236/ Adobe APSB26-92: https://helpx.adobe.com/security/products/magento/apsb26-92.html • ShieldBreak — new Microsoft Defender SYSTEM bypass post-Patch Tuesday. Hunt it. Priority this week: 1. Hotfix Cisco ASA/FTD 2. Patch Windows + reboot 3. Upgrade/block Metabase 4. Apply Adobe APSB26-92 5. Hunt ShieldBreak Full CISA alert: https://www.cisa.gov/news-events/alerts/2026/08/11/cisa-adds-three-known-exploited-vulnerabilities-catalog Verified under primary-source check. @seoscottsdale @CipherWardenAI @CISAgov @CISACyber @Cisco @msftsecresponse @metabase What’s your biggest exposure right now — firewalls, BI tools, or Windows endpoints? #Cybersecurity #AISecurity #KEV #Lazarus
Post summary
The tweet announces three known-exploited CVEs, lists vendor advisories and remedial actions, and emphasizes that the vulnerabilities are actively being abused in the wild.
20000278
12.4K followersView on X
Grok@grok213d
Patch
Las versiones afectadas por CVE-2025-54236 (SessionReaper) en Magento/Adobe Commerce son: - 2.4.9-alpha2 y anteriores - 2.4.8-p2 y anteriores - 2.4.7-p7 y anteriores - 2.4.6-p12 y anteriores - 2.4.5-p14 y anteriores - 2.4.4-p15 y anteriores Aplica el hotfix oficial o actualiza a versión parcheada.
Post summary
The post lists Magento/Adobe Commerce versions affected by CVE‑2025‑54236 and urges users to apply the official hotfix or update to a patched version.
01010278
8.4M followersView on X
CVE Brief@DailyCVEBrief63d
Active Exploitation
LOOK BACK — Adobe patched CVE-2025-54236 on Sept 9, 2025. Nothing happened for 43 days. Then a research writeup dropped on Oct 22 and Magento stores were being backdoored the same day, with 62% of them still unpatched. https://t.co/uLjtz5sS4A
Post summary
Adobe patched CVE‑2025‑54236, but the vulnerability was subsequently exploited to backdoor Magento stores, with a significant portion of them remaining unpatched.
1000052
26 followersView on X
CVETrends@CVEShield213d
General
Top 5 Trending CVEs: 1 - CVE-2025-54236 2 - CVE-2025-38617 3 - CVE-2026-21513 4 - CVE-2026-3102 5 - CVE-2017-7921 #cve #cvetrends #cveshield #cybersecurity https://www.cveshield.com/dashboard
Post summary
The post lists five trending CVE identifiers without providing any technical details, proof of concept, or exploit information.
00010173
1.7K followersView on X
iototsecnews@iototsecnews245d
Active Exploitation
Magento ストア 200 件超を侵害：脆弱性 CVE-2025-54236 の悪用と Rootkit の展開 https://iototsecnews.jp/2026/01/30/over-200-magento-stores-compromised-in-rootkit-rampage-via-zero-day-exploit/ Magento (Adobe Commerce) の深刻な脆弱性 CVE-2025-54236 (SessionReaper) を悪用してオンラインストアを標的とする、大規模な攻撃キャンペーンが報告されました。この攻撃により、認証が完全にバイパスされ、最終的にはサーバ OS レベルの権限 (root) が奪取される恐れがあります。 SessionReaper という名前が示す通り、この攻撃はセッション管理の不備を突くものです。具体的には、Magento の REST API における入力検証の脆弱性を利用し、無効化されるべきセッション・トークンを再利用することで、攻撃者は正規の管理者やユーザーになりすまします。さらに、ファイルベースのセッション・ストレージを使用している環境では、このセッション・ハイジャックからリモートコード実行 (RCE) へと攻撃を繋げることが可能とされます。ご利用のチームは、ご注意ください。 #CVE202554236 #Exploit #Government #Magento #Retail #Vulnerability
Post summary
The article details a widespread Magento attack campaign exploiting CVE‑2025‑54236, achieving authentication bypass and potential root access, with over 200 stores compromised.
01000216
483 followersView on X
セキュリティ対策Lab@securityLab_jp248d
Active Exploitation
Magentoの脆弱性CVE-2025-54236がサイバー攻撃へ悪用-日本ドメインへのWebシェル設置も https://rocket-boys.co.jp/security-measures-lab/magento-vulnerability-cve-2025-54236-exploited-in-cyberattacks-web-shells-deployed-on-japanese-domains/ #セキュリティ対策Lab #セキュリティ #Security #CybersecurityNews
Post summary
Magento CVE‑2025‑54236 has been actively exploited, with attackers deploying web shells on Japanese domains.
10000176
318 followersView on X
Autumn Good@autumn_good_35251d
Active Exploitation
SessionReaperの被害は日本の複数サイトでも確認されているとのこと。（一部jpドメインが隠しきれていない...） Exploitation of Magento CVE-2025-54236: Independent Intrusions Leading to Root Compromise and Web Shell Deployment https://oasis-security.io/blog/260128-Magento-CVE
Post summary
The passage reports observed exploitation of Magento CVE-2025-54236, including independent intrusions that achieved root compromise and web shell deployment, and notes SessionReaper malware activity on multiple Japanese sites.
00010407
6.7K followersView on X
OASIS SECURITY@OASIS_SECURITY_254d
Active Exploitation
Exploitation of Magento CVE-2025-54236: Independent Intrusions Leading to Root Compromise and Web Shell Deployment 📌 New TI Report ▶ https://oasis-security.io/blog/260128-Magento-CVE?utm_source=twitter&utm_medium=social&utm_campaign=blog_share #ThreatIntelligence #DataLeak #Magento #CVE202554236
Post summary
The tweet reports that Magento CVE-2025-54236 has been exploited in the wild, leading to root compromise and web shell deployment, but provides no PoC, patch, or technical details.
10000190
3 followersView on X
CVE Brief@DailyCVEBrief63d
General
Full Look Back: the 2018 pull request that introduced the bug, why the 2024 CosmicSting fix did not cover it, and what the exploitation curve says about silent patching. https://cvebrief.com/cve/CVE-2025-54236/ https://t.co/0VuxyfwcNT
Post summary
The tweet references CVE‑2025‑54236 and discusses why a prior 2024 fix did not address it, but it does not mention any PoC, exploit, active exploitation, patch, or technical details of the vulnerability.
0000039
26 followersView on X
BBWriteup@bbwriteup95d
General
"Analyzing SessionReaper (CVE-2025–54236): An Offensive-Informed DFIR Analysis" by INTfinity Consulting #InfoSec #CyberSecurity #Hacking #BugBounty https://medium.com/@INTfinitySG/analyzing-sessionreaper-cve-2025-54236-an-offensive-informed-dfir-analysis-8237fcfc8e03
Post summary
The Medium article appears to be a standard DFIR analysis of CVE‑2025‑54236, but the excerpt provides no concrete evidence of a PoC, exploit, active use, patch, technical detail, or debunking claim.
00000133
760 followersView on X
CyberX@CyberXlx9q105d
PoC
‼️𝗔𝗹𝗹𝗲𝗴𝗲𝗱 𝗥𝗲𝗹𝗲𝗮𝘀𝗲 𝗼𝗳 𝗔𝗱𝗼𝗯𝗲 𝗠𝗮𝗴𝗲𝗻𝘁𝗼 “𝗦𝗲𝘀𝘀𝗶𝗼𝗻𝗥𝗲𝗮𝗽𝗲𝗿” 𝗟𝗙𝗜 𝗘𝘅𝗽𝗹𝗼𝗶𝘁 A threat actor claims to have released information and a proof-of-concept (PoC) for CVE-2025-54236, an alleged Local File Inclusion (LFI) vulnerability affecting Adobe Magento. According to the post, the vulnerability is said to stem from insufficient input validation in certain API requests, potentially allowing attackers to read sensitive files from affected systems. The actor further claims that successful exploitation could facilitate session hijacking and, under specific conditions, may contribute to remote code execution (RCE) scenarios, although the published material reportedly focuses on LFI techniques. If authentic, exploitation of such a vulnerability could expose sensitive application files, session data, configuration information, and other resources that may be leveraged in follow-on attacks against vulnerable Magento deployments. The authenticity of the claimed vulnerability, the effectiveness of the published proof-of-concept, and the threat actor’s assertions have not been independently verified. Organizations operating Adobe Magento environments should monitor official security advisories and apply vendor-issued updates or mitigations when available. #CyberSecurity #Adobe #Magento #Vulnerability #CVE202554236 #ThreatIntel #ApplicationSecurity
Post summary
A threat actor claims to have released a PoC for CVE‑2025‑54236, an LFI vulnerability in Adobe Magento, but there is no evidence of active exploitation or an existing exploit tool. Adobe Magento operators should monitor advisories and apply vendor patches as they become available.
00000308
336 followersView on X
DailyCVE@dailycve168d
Disclosure
🔵 pgx (Go), SQL Injection via Placeholder Confusion, #CVE-2025-54236 (Low severity) https://dailycve.com/pgx-go-sql-injection-via-placeholder-confusion-cve-2025-54236-low-severity/
Post summary
The post announces CVE‑2025‑54236, a low‑severity SQL injection flaw in the pgx Go library caused by placeholder confusion. No exploit code, active exploitation, or patch is mentioned.
00000207
183 followersView on X
でえもん@川口将貴@dmnlk177d
General
Check if your Magento site is safe from Session Reaper (CVE-2025-54236) https://www.sdj.pw/posts/magento2-session-reaper-cve-2025-54236/ #magento2 #security #devsecops #magento-cloud #adobe-commerce
Post summary
The post is a generic advisory prompting Magento site owners to verify if they are vulnerable to CVE-2025-54236, with no PoC, exploit code, patch, or technical details provided.
00000388
2.0K followersView on X

CPE platform detail152 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

152 of 152 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	adobe	commerce	2.4.4	-	-
App	adobe	commerce	2.4.4	-	-
App	adobe	commerce	2.4.4	-	-
App	adobe	commerce	2.4.4	-	-
App	adobe	commerce	2.4.4	-	-
App	adobe	commerce	2.4.4	-	-
App	adobe	commerce	2.4.4	-	-
App	adobe	commerce	2.4.4	-	-
App	adobe	commerce	2.4.4	-	-
App	adobe	commerce	2.4.4	-	-
App	adobe	commerce	2.4.4	-	-
App	adobe	commerce	2.4.4	-	-
App	adobe	commerce	2.4.4	-	-
App	adobe	commerce	2.4.4	-	-
App	adobe	commerce	2.4.4	-	-
App	adobe	commerce	2.4.4	-	-
App	adobe	commerce	2.4.5	-	-
App	adobe	commerce	2.4.5	-	-
App	adobe	commerce	2.4.5	-	-
App	adobe	commerce	2.4.5	-	-
App	adobe	commerce	2.4.5	-	-
App	adobe	commerce	2.4.5	-	-
App	adobe	commerce	2.4.5	-	-
App	adobe	commerce	2.4.5	-	-
App	adobe	commerce	2.4.5	-	-
App	adobe	commerce	2.4.5	-	-
App	adobe	commerce	2.4.5	-	-
App	adobe	commerce	2.4.5	-	-
App	adobe	commerce	2.4.5	-	-
App	adobe	commerce	2.4.5	-	-
App	adobe	commerce	2.4.5	-	-
App	adobe	commerce	2.4.6	-	-
App	adobe	commerce	2.4.6	-	-
App	adobe	commerce	2.4.6	-	-
App	adobe	commerce	2.4.6	-	-
App	adobe	commerce	2.4.6	-	-
App	adobe	commerce	2.4.6	-	-
App	adobe	commerce	2.4.6	-	-
App	adobe	commerce	2.4.6	-	-
App	adobe	commerce	2.4.6	-	-
App	adobe	commerce	2.4.6	-	-
App	adobe	commerce	2.4.6	-	-
App	adobe	commerce	2.4.6	-	-
App	adobe	commerce	2.4.6	-	-
App	adobe	commerce	2.4.7	-	-
App	adobe	commerce	2.4.7	-	-
App	adobe	commerce	2.4.7	-	-
App	adobe	commerce	2.4.7	-	-
App	adobe	commerce	2.4.7	-	-
App	adobe	commerce	2.4.7	-	-
App	adobe	commerce	2.4.7	-	-
App	adobe	commerce	2.4.7	-	-
App	adobe	commerce	2.4.7	-	-
App	adobe	commerce	2.4.7	-	-
App	adobe	commerce	2.4.7	-	-
App	adobe	commerce	2.4.8	-	-
App	adobe	commerce	2.4.8	-	-
App	adobe	commerce	2.4.8	-	-
App	adobe	commerce	2.4.8	-	-
App	adobe	commerce	2.4.8	-	-
App	adobe	commerce	2.4.9	-	-
App	adobe	commerce	2.4.9	-	-
App	adobe	commerce_b2b	1.3.3	-	-
App	adobe	commerce_b2b	1.3.3	-	-
App	adobe	commerce_b2b	1.3.3	-	-
App	adobe	commerce_b2b	1.3.3	-	-
App	adobe	commerce_b2b	1.3.3	-	-
App	adobe	commerce_b2b	1.3.3	-	-
App	adobe	commerce_b2b	1.3.3	-	-
App	adobe	commerce_b2b	1.3.3	-	-
App	adobe	commerce_b2b	1.3.3	-	-
App	adobe	commerce_b2b	1.3.3	-	-
App	adobe	commerce_b2b	1.3.3	-	-
App	adobe	commerce_b2b	1.3.3	-	-
App	adobe	commerce_b2b	1.3.3	-	-
App	adobe	commerce_b2b	1.3.3	-	-
App	adobe	commerce_b2b	1.3.3	-	-
App	adobe	commerce_b2b	1.3.3	-	-
App	adobe	commerce_b2b	1.3.4	-	-
App	adobe	commerce_b2b	1.3.4	-	-
App	adobe	commerce_b2b	1.3.4	-	-
App	adobe	commerce_b2b	1.3.4	-	-
App	adobe	commerce_b2b	1.3.4	-	-
App	adobe	commerce_b2b	1.3.4	-	-
App	adobe	commerce_b2b	1.3.4	-	-
App	adobe	commerce_b2b	1.3.4	-	-
App	adobe	commerce_b2b	1.3.4	-	-
App	adobe	commerce_b2b	1.3.4	-	-
App	adobe	commerce_b2b	1.3.4	-	-
App	adobe	commerce_b2b	1.3.4	-	-
App	adobe	commerce_b2b	1.3.4	-	-
App	adobe	commerce_b2b	1.3.4	-	-
App	adobe	commerce_b2b	1.3.4	-	-
App	adobe	commerce_b2b	1.4.2	-	-
App	adobe	commerce_b2b	1.4.2	-	-
App	adobe	commerce_b2b	1.4.2	-	-
App	adobe	commerce_b2b	1.4.2	-	-
App	adobe	commerce_b2b	1.4.2	-	-
App	adobe	commerce_b2b	1.4.2	-	-
App	adobe	commerce_b2b	1.4.2	-	-
App	adobe	commerce_b2b	1.4.2	-	-
App	adobe	commerce_b2b	1.5.2	-	-
App	adobe	commerce_b2b	1.5.2	-	-
App	adobe	commerce_b2b	1.5.2	-	-
App	adobe	commerce_b2b	1.5.3	-	-
App	adobe	commerce_b2b	1.5.3	-	-
App	adobe	magento	2.4.5	-	-
App	adobe	magento	2.4.5	-	-
App	adobe	magento	2.4.5	-	-
App	adobe	magento	2.4.5	-	-
App	adobe	magento	2.4.5	-	-
App	adobe	magento	2.4.5	-	-
App	adobe	magento	2.4.5	-	-
App	adobe	magento	2.4.5	-	-
App	adobe	magento	2.4.5	-	-
App	adobe	magento	2.4.5	-	-
App	adobe	magento	2.4.5	-	-
App	adobe	magento	2.4.5	-	-
App	adobe	magento	2.4.5	-	-
App	adobe	magento	2.4.5	-	-
App	adobe	magento	2.4.5	-	-
App	adobe	magento	2.4.6	-	-
App	adobe	magento	2.4.6	-	-
App	adobe	magento	2.4.6	-	-
App	adobe	magento	2.4.6	-	-
App	adobe	magento	2.4.6	-	-
App	adobe	magento	2.4.6	-	-
App	adobe	magento	2.4.6	-	-
App	adobe	magento	2.4.6	-	-
App	adobe	magento	2.4.6	-	-
App	adobe	magento	2.4.6	-	-
App	adobe	magento	2.4.6	-	-
App	adobe	magento	2.4.6	-	-
App	adobe	magento	2.4.6	-	-
App	adobe	magento	2.4.7	-	-
App	adobe	magento	2.4.7	-	-
App	adobe	magento	2.4.7	-	-
App	adobe	magento	2.4.7	-	-
App	adobe	magento	2.4.7	-	-
App	adobe	magento	2.4.7	-	-
App	adobe	magento	2.4.7	-	-
App	adobe	magento	2.4.7	-	-
App	adobe	magento	2.4.7	-	-
App	adobe	magento	2.4.7	-	-
App	adobe	magento	2.4.7	-	-
App	adobe	magento	2.4.8	-	-
App	adobe	magento	2.4.8	-	-
App	adobe	magento	2.4.8	-	-
App	adobe	magento	2.4.8	-	-
App	adobe	magento	2.4.8	-	-
App	adobe	magento	2.4.9	-	-
App	adobe	magento	2.4.9	-	-

Explore more

Back to dashboard adobe CVEs commerce vulnerabilities

What researchers are saying

CVE-2025-54236

Germán Fernández[verified]@1ZRR4HActive Exploitation

The post announces a PoC for an unauthenticated file upload flaw in Magento, confirms mass exploitation in the wild, and provides a link to the detailed PoC.

Germán Fernández[verified]@1ZRR4HPoC

The post announces a new PoC (checker) to validate sites vulnerable to CVE‑2025‑54236, with a link to the relevant blog, without mentioning patches, active exploitation, or detailed technical data.

Grok[verified]@grokActive Exploitation

The post reports real-world attacks exploiting CVE-2025-54236 in Magento/Adobe Commerce, with attackers defacing sites and the vulnerability enabling webshells/RCE, alongside a call for users to promptly update.

Adam[verified]@seoscottsdaleActive Exploitation

The tweet announces three known-exploited CVEs, lists vendor advisories and remedial actions, and emphasizes that the vulnerabilities are actively being abused in the wild.

Grok[verified]@grokPatch

The post lists Magento/Adobe Commerce versions affected by CVE‑2025‑54236 and urges users to apply the official hotfix or update to a patched version.

CVE Brief[verified]@DailyCVEBriefActive Exploitation

Adobe patched CVE‑2025‑54236, but the vulnerability was subsequently exploited to backdoor Magento stores, with a significant portion of them remaining unpatched.

セキュリティ対策Lab[verified]@securityLab_jpActive Exploitation

Magento CVE‑2025‑54236 has been actively exploited, with attackers deploying web shells on Japanese domains.

OASIS SECURITY[verified]@OASIS_SECURITY_Active Exploitation

The tweet reports that Magento CVE-2025-54236 has been exploited in the wild, leading to root compromise and web shell deployment, but provides no PoC, patch, or technical details.