CVE-2025-54236: Session Takeover in Adobe Commerce

CVE-2025-54236 is an improper input validation vulnerability affecting Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier. The flaw allows attackers to achieve session takeover, compromising both confidentiality and integrity of data. No user interaction is required, making it particularly dangerous in production environments.

Severity is declared critical with CVSS 9.1. The CVE was published on September 9, 2025. Notable signal: GitHub indicators from November 7, 2026 show a free security patch exists (Big Cart Energy) for Magento 2.3 and 2.4 versions lacking official Adobe fixes, confirming some releases remain uncovered. This suggests the vulnerability remains active in environments running abandoned releases.

Immediately verify which version of Adobe Commerce runs in production. If running 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 or earlier, apply the official Adobe patch as soon as available. For versions lacking official patches, evaluate the community solution available on GitHub. Monitor user session access and verify the Web API input processor is correctly configured per Adobe security guidelines.