CVE-2025-54236: 
PHP vulnerability analysis and mitigation

CVE-2025-54236, dubbed SessionReaper, is a critical Improper Input Validation vulnerability (CWE-20) in Adobe Commerce and Magento Open Source that allows unauthenticated remote attackers to take over customer accounts via the Commerce REST API. Affected versions include Adobe Commerce 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier, as well as corresponding Magento Open Source and Commerce B2B releases. Adobe disclosed and patched the vulnerability on September 9, 2025, via security advisory APSB25-88. It carries a CVSS v3.1 base score of 9.1 (Critical) (Adobe Advisory, CISA KEV).

The root cause is insufficient input validation in the Adobe Commerce/Magento REST API endpoint that handles customer-facing operations, classified as CWE-20 (Improper Input Validation). Researchers at Assetnote/SLC Cyber discovered that the vulnerability involves nested deserialization — crafted payloads submitted to the REST API bypass input sanitization, enabling session token manipulation and ultimately unauthenticated session takeover (SLC Cyber Research). SonicWall's analysis further confirmed the nested deserialization chain can be escalated to achieve unauthenticated Remote Code Execution (RCE) beyond the initial session hijacking primitive (SonicWall Blog). Exploitation requires no authentication, no user interaction, and is network-accessible with low attack complexity.

Successful exploitation allows attackers to take over arbitrary customer accounts (high confidentiality and integrity impact) without any user interaction, enabling unauthorized access to stored payment methods, order history, and personal data. In more advanced exploitation chains, attackers can achieve unauthenticated RCE, leading to webshell deployment, rootkit installation, and full server compromise — as observed in real-world attacks where over 200–250 Magento stores were compromised with root-level access (BleepingComputer, Security Affairs). The availability impact is rated None in the base CVSS score, but real-world attacks have demonstrated lateral movement, data exfiltration, and persistent backdoor installation on compromised e-commerce infrastructure.

CVE-2025-54236 is actively exploited in the wild and was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on October 24, 2025, with a remediation due date of November 14, 2025 (CISA KEV). Multiple public exploits are available, including a Metasploit module (magento_sessionreaper) merged into the Rapid7 framework in December 2025, PoC code on GitHub, and a write-up on nullsecurityx.codes (Metasploit Module, Rapid7 Blog). Sansec reported active exploitation beginning around October 23, 2025, with over 250 stores compromised overnight; a subsequent wave in early 2026 compromised 200+ additional stores with rootkit-level access (Sansec Research). The EPSS score is approximately 0.33%, though real-world exploitation rates far exceed this estimate given documented mass exploitation campaigns. Dark web and Telegram channels have also been observed distributing exploit tooling (Flare.io).

1. Reconnaissance: Use Shodan, Censys, or FOFA to identify internet-facing Adobe Commerce or Magento Open Source instances running vulnerable versions (≤2.4.8-p2, ≤2.4.7-p7, ≤2.4.6-p12, ≤2.4.5-p14, ≤2.4.4-p15). Version fingerprinting can be done via the Magento REST API endpoint /rest/V1/store/storeConfigs or by inspecting page source metadata.
2. Craft malicious payload: Construct a specially crafted HTTP request targeting the Commerce REST API that contains a nested deserialized payload designed to bypass input validation. The payload exploits the improper handling of serialized data in customer-facing API endpoints.
3. Submit to vulnerable endpoint: Send the crafted POST request to the vulnerable REST API endpoint (e.g., related to customer address or file upload functionality). No authentication token is required.
4. Session takeover: The server processes the malicious input without proper validation, allowing the attacker to manipulate or forge session tokens, effectively taking over an existing customer or admin account.
5. Escalate to RCE (optional): Using the nested deserialization chain identified by Assetnote/SonicWall, extend the payload to trigger server-side code execution, enabling webshell upload or reverse shell establishment as the web server process user.
6. Establish persistence: Deploy a webshell or rootkit to maintain persistent access; inject malicious JavaScript (Magecart-style skimmer) into checkout pages to harvest payment card data from future customers (SLC Cyber Research, SonicWall Blog).

• Network: Anomalous POST requests to Magento/Adobe Commerce REST API endpoints (e.g., /rest/V1/customers/, /rest/V1/guest-carts/, customer address or file upload endpoints) containing unusually large or encoded serialized payloads; unexpected outbound connections from the web server to external IPs.
• Logs: Web server access logs showing repeated API requests with malformed or oversized body content from single or rotating IP addresses; Magento exception logs (var/log/exception.log) showing deserialization errors or unexpected PHP object instantiation.
• File System: Newly created PHP files in pub/, var/, or Magento module directories not matching known Magento files; modified index.php or .htaccess files; presence of webshells (e.g., files with names like shell.php, cmd.php, or random alphanumeric filenames).
• Process: Unexpected child processes spawned by the PHP-FPM or Apache/Nginx process (e.g., bash, curl, wget, python, nc); unusual cron jobs added to the web server user's crontab.
• Application: Unexpected admin account creation or privilege escalation in Magento admin panel; customer accounts with modified email addresses or session tokens; JavaScript skimmer code injected into checkout or payment pages (Sansec Research, BleepingComputer).

Adobe released patched versions via advisory APSB25-88 on September 9, 2025. Organizations should upgrade to the following minimum versions immediately:

• Adobe Commerce / Magento Open Source: 2.4.5-p15, 2.4.6-p13, 2.4.7-p8, 2.4.8-p3, or 2.4.9 (final release)
• Commerce B2B: Corresponding patched versions per the advisory

For organizations unable to patch immediately:

• Deploy WAF rules to block malicious REST API payloads (Cloudflare released emergency WAF rules on October 23, 2025; Citrix NetScaler and FortiGuard IPS signatures are also available)
• Restrict access to the Magento REST API to known IP ranges where operationally feasible
• Invalidate all active customer sessions as a precautionary measure
• Monitor for indicators of compromise and audit admin accounts for unauthorized changes

CISA mandates remediation for federal agencies by November 14, 2025 (Adobe Advisory, CISA KEV, Adobe Experience League).

Adobe issued an emergency patch and confirmed active exploitation in their advisory APSB25-88, with the vulnerability receiving widespread media coverage from BleepingComputer, The Hacker News, Dark Reading, TechRadar, and SC World within days of exploitation being detected (BleepingComputer, The Hacker News). Sansec, a specialist Magento security firm, published detailed exploitation research and tracked the mass compromise campaigns in real time (Sansec Research). Security researchers on Mastodon and Bluesky widely shared alerts, and the Qualys Threat Protect team confirmed active exploitation in attacks. The Malwarebytes blog noted thousands of online stores remained at risk due to slow patching rates, and Akamai published a Halloween-themed analysis highlighting the severity. Community sentiment on Reddit (r/Magento, r/SecOpsDaily) reflected urgency, with many store operators seeking workarounds for older unsupported versions.