—–BEGIN PGP SIGNED MESSAGE—–

Hash: SHA256

Input Validation Vulnerability in Adobe Commerce 

Indian – Computer Emergency Response Team (https://www.cert-in.org.in)

Severity Rating: CRITICAL

Software Affected

Adobe Commerce 

2.4.9-alpha2 and earlier

2.4.8-p2 and earlier

2.4.7-p7 and earlier

2.4.6-p12 and earlier

2.4.5-p14 and earlier

2.4.4-p15 and earlier

Adobe Commerce B2B

1.5.3-alpha2 and earlier

1.5.2-p2 and earlier

1.4.2-p7 and earlier

1.3.4-p14 and earlier

1.3.3-p15 and earlier

Magento Open Source

2.4.9-alpha2 and earlier

2.4.8-p2 and earlier

2.4.7-p7 and earlier

2.4.6-p12 and earlier

2.4.5-p14 and earlier

Overview

A vulnerability has been reported in Adobe Commerce , which could allow an unauthenticated attacker to bypass certain security features on the targeted system.

Target Audience:

System administrators, Security teams or end-users of Adobe products.

Risk Assessment:

High risk of unauthorised access to sensitive data and system instability.

Impact Assessment:

Potential for data theft, remote code execution or system compromise.

Description

Adobe Commerce is an enterprise-grade e-commerce platform that enables organisations to build, manage, and scale online stores. It provides features for product management, order processing, customer engagement, and secure payment integration.

This vulnerability exists due to improper input validation in Adobe Commerce¿s REST API. A remote attacker could exploit this flaw by sending specially crafted API requests to the affected instance.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to bypass certain security features on the targeted system.

Note: This vulnerability (CVE-2025-54236) is being exploited in the wild.

Solution

Apply appropriate updates as mentioned in the Adobe Security Bulletin.

https://helpx.adobe.com/security/products/magento/apsb25-88.html

Vendor Information

Adobe

https://helpx.adobe.com/security/products/magento/apsb25-88.html

References

 

https://helpx.adobe.com/security/products/magento/apsb25-88.html

https://www.bleepingcomputer.com/news/security/hackers-exploiting-critical-sessionreaper-flaw-in-adobe-magento/

CVE Name

CVE-2025-54236

– —

Thanks and Regards,

CERT-In

Incident Response Help Desk

e-mail: incident@cert-in.org.in

Phone: +91-11-22902657

Toll Free Number: 1800-11-4949

Toll Free Fax : 1800-11-6969

Web: http://www.cert-in.org.in

PGP Fingerprint: A768 083E 4475 5725 B81A A379 2156 C0C0 B620 D0B4

PGP Key information:

https://www.cert-in.org.in/s2cMainServlet?pageid=CONTACTUS

Postal address:

Indian Computer Emergency Response Team (CERT-In)

Ministry of Electronics and Information Technology

Government of India

Electronics Niketan

6, C.G.O. Complex

New Delhi-110 003

—–BEGIN PGP SIGNATURE—–

iQIzBAEBCAAdFiEE6r4Iam/Ey0c/KakL3jCgcSdcys8FAmj824gACgkQ3jCgcSdc

ys81Zg/9H1O+Dq9s24x684zSQiGHT2rv96/AFOrl0+Q3jIFMVzqFSvYJs+UVhKe5

x/I8HEcwd8dbI4XeeM1pKsTWj+TvcikrUZIR0jYp1CgOugMCpJEtcgv+tiO4b3A8

fkx5P+cfhsRv9fUvBB/Kr7DWZUBbixn1D8mxxPyjYB8gX+jhdUJ8l158d4+NNcvT

yzNyXabR8GjTe4Ap3X/NGkWVOJgDvcauI3FeKVRq1p8KiF+ljn9ak9RLQ/7HTfsL

uZyMEXC1w2K+w0k9D3BbnimgGhx8YnBkzBZn1HpIGU3aNkQuVxPY6W+ZkNyY7TYt

XbLWVbIni3KOQql/wmyMBqRYyYzwyj52QaR+l/lSHql3yTn+Yl6VEZ5xMivnCFLf

lqIKSr+rXpd/U2Mzi1yZkhSciVazflMc0MuV/S+6d39uXnq27qHhmvyArj8/ETHo

zf871l1dtEiDBujtlaQG1Q5EH/b6dFbpbWWj3NFPeT/4y/8MMMYDriKHq0xtnVE+

h61AQwHIYT+dM+Qgb+ifpS2IzgaT5gEnZeEzdMr3TOaWkc2S0/dbOYnmQrkEMfNZ

Awls83vvmQMjIyu5mSlPyKRniEjWk4TLyhm67Z2z3QDlJKz/d0HR+Dzo1w50bNIv

TtDRR1fNEbVfxEA2hF7N7z+t6IBfH60QQppB85QQ4aIuumJGgYE=

=T7T7

—–END PGP SIGNATURE—–