CVE-2025-54236

The error results from improper input validation in Adobe Commerce. An attacker, without possessing an account or requiring any user interaction, can supply crafted input data to the vulnerable application mechanism. This results in hijacking an active session of another user — potentially including store administrators — giving the attacker high-level access to sensitive data and the ability to modify resources.

An attacker can gain full control over a hijacked session, resulting in high impact on confidentiality (access to customer data, orders, configuration) and system integrity (ability to introduce unauthorized changes). The vulnerability does not directly affect system availability.

Adobe Commerce and Magento must be immediately updated to versions containing the patch described in the vendor security bulletin APSB25-88 (https://helpx.adobe.com/security/products/magento/apsb25-88.html). Due to active exploitation in production environments, the update should be an immediate priority. Until the patch is deployed, enhanced session monitoring is recommended and restricting access to the administrative panel should be considered.

Adobe Commerce and Adobe Magento in versions: 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier. Also affects Adobe Commerce B2B.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API.