Critical severity · published Sep 9, 2025
CVE-2025-54236
Adobe Commerce | Improper Input Validation (CWE-20)
In wildKEV
9.1
CVSS
94.7%
EPSS
Yes
On KEV
Description
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)94.7% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Oct 24, 2025
Federal remediation dueNov 14, 2025
Ransomware campaign useNot known
Affected products
Which versions
CO
Commerce · Adobe
through 2.4.4-p15 · source: vendor, NVD
CB
Commerce B2b · Adobe
1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; +34 more · source: NVD
CA
Commerce and Magento · Adobe
All versions, or not specified · source: KEV
In the news
VulnerabilityHigh
[CISA KEV] CVE-2025-54236: Adobe Commerce and Magento - Adobe Commerce and Magento Improper Input Validation Vulnerability
Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API.
CACommerce and MagentoCVE-2025-54236
Oct 24, 2025·CISA KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-54236
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-54236
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
vendor-advisory
https://helpx.adobe.com/security/products/magento/apsb25-88.html
More from Commerce
10.0
CVE-2026-75650
Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
9.8
CVE-2024-34102
XXE can expose crypt key and other secrets granting full admin access
9.8
CVE-2022-24086
Adobe Commerce checkout improper input validation leads to remote code execution
9.3
CVE-2026-48356
Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)
9.1
CVE-2026-71362
Adobe Commerce | Incorrect Authorization (CWE-863)