Full Report
Adobe is warning of a critical vulnerability (CVE-2025-54236) in its Commerce and Magento Open Source platforms that researchers call SessionReaper and describe as one of " the most severe" flaws in the history of the product. [...]
Analysis Summary
# Vulnerability: Adobe Magento "SessionReaper" Critical Flaw (CVE-2025-54236)
## CVE Details
- CVE ID: CVE-2025-54236
- CVSS Score: Not explicitly provided, but described as **Critical** and "one of the most severe" in Magento history.
- CWE: Not specified in the summary, but likely related to insecure deserialization or improper access control given the impact description.
## Affected Systems
- Products: Adobe Commerce and Magento Open Source platforms.
- Versions: Not explicitly listed, but patches are available for the fix released on September 9, 2025.
- Configurations: Successful exploitation "appears" to depend on storing session data on the file system, which is a default configuration.
## Vulnerability Description
This critical vulnerability abuses the Commerce REST API. Successful, unauthenticated exploitation allows an attacker to take control of customer accounts. The flaw reportedly follows a pattern similar to the previous CosmicSting attack and involves internal Magento functionality related to constructor parameter injection in the REST API.
## Exploitation
- Status: Adobe and researchers are **not aware of any active exploitation in the wild**. However, an initial hotfix was leaked last week, potentially giving threat actors a head start.
- Complexity: Implied **Medium/Low** given the potential for automation at scale and similarity to previous exploits.
- Attack Vector: **Network** (via REST API).
## Impact
- Confidentiality: High (Potential for account takeover/customer data access).
- Integrity: High (Potential for session forging, privilege escalation, and unauthorized actions).
- Availability: Moderate (Less direct impact mentioned, but system compromise reduces availability/trust).
## Remediation
### Patches
- Administrators are strongly advised to deploy the immediately available patch package (VULN-32437-2-4-X-patch.zip). Direct download link provided in source material.
### Workarounds
- For customers using **Adobe Commerce on Cloud**, a Web Application Firewall (WAF) rule deployed by Adobe served as an intermediate protective measure. No other generic workarounds provided for self-hosted installations other than applying the patch.
## Detection
- **Indicators of Compromise:** Not explicitly detailed, but related to unauthorized session manipulation or customer account interaction via the REST API.
- **Detection methods and tools:** Sansec notes the vulnerability relates to internal Magento functionality changed in the fix for constructor parameter injection in the REST API (referencing updated Adobe documentation).
## References
- Vendor Advisory: hxxps://helpx.adobe.com/security/products/magento/apsb25-88.html
- Researcher Advisory: hxxps://sansec.io/research/sessionreaper
- Affected Documentation Changes: hxxps://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-27501
- Adobe Confirmation: hxxps://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-27397