CVE-2025-54236: listed in the CISA KEV catalog CVE-2025-54236 · CVSS 9.1 CRITICAL · EPSS 95% · KEV 2025-10-24
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.
Is CVE-2025-54236 exploited? Listed in the CISA KEV catalog on 2025-10-24. Federal remediation due 2025-11-14. Past that date by 347 days. EPSS puts exploitation in the next 30 days at 95%. Public exploit code: packaged in a public tool. Public detection rules exist. Which products and versions are affected? Adobe · Adobe Commerce · 0 - 2.4.4-p15 adobe · commerce b2b · 1.3.3, 1.3.4, 1.4.2, 1.5.2, 1.5.3 adobe · magento · 2.4.5, 2.4.6, 2.4.7, 2.4.8, 2.4.9 Is there a patch? Adobe's record doesn't name a fixed version.
Adobe advisory
What PlainSec published about CVE-2025-54236 Primary sources What this record does not say KEV and EPSS are re-checked daily. Record last updated 2026-10-26.
CVE-2025-54236: listed in the CISA KEV catalog CVE-2025-54236 · CVSS 9.1 CRITICAL · EPSS 95% · KEV 2025-10-24
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.
Is CVE-2025-54236 exploited? Listed in the CISA KEV catalog on 2025-10-24. Federal remediation due 2025-11-14. Past that date by 347 days. EPSS puts exploitation in the next 30 days at 95%. Public exploit code: packaged in a public tool. Public detection rules exist. Which products and versions are affected? Adobe · Adobe Commerce · 0 - 2.4.4-p15 adobe · commerce b2b · 1.3.3, 1.3.4, 1.4.2, 1.5.2, 1.5.3 adobe · magento · 2.4.5, 2.4.6, 2.4.7, 2.4.8, 2.4.9 Is there a patch? Adobe's record doesn't name a fixed version.
Adobe advisory
What PlainSec published about CVE-2025-54236 Primary sources What this record does not say KEV and EPSS are re-checked daily. Record last updated 2026-10-26.