CVE-2025-54236

Critical9.1 Published on Sep 9, 2025

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.

Actively exploited

In the CISA exploited-vulnerabilities catalogue since Oct 24, 2025
US federal agencies must remediate it by Nov 14, 2025 (BOD 22-01)
First attack observed 41 days after disclosure
Confirmed by sensors, not only by reports

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Source: CISA KEV · Oct 26, 2026 Oct 24, 2026 Oct 18, 2026 Oct 3, 2026 Oct 2, 2026 Oct 1, 2026

CVSS score9.1 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness type (CWE)CWE-20

Vendorsadobe