Introduction
For an e-commerce business, session hijacking and administrative account takeover have immediate consequences. Adobe treated CVE-2025-54236 in Adobe Commerce and Magento as an emergency. It released a critical patch outside its regular schedule because of the risk of widespread compromise.
Adobe Commerce (formerly Magento) is used by hundreds of thousands of online retailers around the world, from small businesses to large enterprises. Its flexibility and extensibility helped make it that widely used. It is also a frequent target for attackers who want to exploit vulnerabilities for financial gain.
Technical information
CVE-2025-54236 is a critical improper input validation vulnerability in the Web API ServiceInputProcessor component of Adobe Commerce and Magento. It lets unauthenticated attackers send crafted API requests that bypass the intended security controls. The root cause is insufficient sanitization and type validation of nested objects passed through REST, GraphQL, or SOAP API endpoints.
To exploit it, an attacker sends a payload that the ServiceInputProcessor does not validate properly. The payload injects unexpected parameter types or objects, and those can trigger unintended code execution paths. The flaw is closely related to CWE-20 (Improper Input Validation). It needs no user interaction and no authentication, which is why it is particularly dangerous.
Technical analysis from Sansec and other researchers indicates that exploitation is feasible on systems using file-based session storage. That is the default configuration for most Adobe Commerce and Magento installations. Adobe's emergency patch adds stricter parameter type checks. It accepts only recognized scalar types or API data objects and rejects anything unexpected, which addresses the insufficient validation behind the vulnerability directly.
Affected systems and versions
CVE-2025-54236 affects these Adobe Commerce and Magento versions:
- Adobe Commerce 2.4.9-alpha2
- Adobe Commerce 2.4.8-p2
- Adobe Commerce 2.4.7-p7
- Adobe Commerce 2.4.6-p12
- Adobe Commerce 2.4.5-p14
- Adobe Commerce 2.4.4-p15
- All earlier versions
The vulnerability is exploitable on systems that use file-based session storage, the default configuration for most installations.
Vendor security history
Adobe has patched critical vulnerabilities in its Commerce (Magento) platform before. Notable past issues include:
- Shoplift (2015)
- Ambionics SQLi (2019)
- TrojanOrder (2022)
- CosmicSting (2024)
Adobe normally releases security updates quarterly. For severe, high-impact vulnerabilities it has issued emergency patches instead, breaking its schedule when necessary. It also works with security researchers.
