Hackers are actively exploiting the critical SessionReaper vulnerability (CVE-2025-54236) in Adobe Commerce (formerly Magento) platforms, with hundreds of attempts recorded.
The activity was spotted by e-commerce security firm Sansec, whose researchers previously described SessionReaper as one of the most severe security bugs in the history of the product.
Adobe warned about CVE-2025-54236 on September 8, saying that it is an improper input validation vulnerability that impacts Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 (and earlier).
An attacker successfully exploiting the flaw can take control of account sessions without any user interaction.
"A potential attacker could take over customer accounts in Adobe Commerce through the Commerce REST API," Adobe explains.
Sansec previously stated that successful exploitation likely depends on storing session data on the file system, the default configuration used by most stores, and that a leaked hotfix from the vendor could provide clues on how it can be leveraged..
Roughly six weeks after the emergency patch for SessionReaper became available, Sansec is confirming active exploitation in the wild.
"Six weeks after Adobe's emergency patch for SessionReaper (CVE-2025-54236), the vulnerability has entered active exploitation," reads Sansec's bulletin.
"Sansec Shield detected and blocked the first real-world attacks today, which is bad news for the thousands of stores that remain unpatched," the researchers said.
Just today, Sansec blocked more than 250 SessionReaper exploitation attempts targeting multiple stores, most of the attacks originating from five IP addresses:
... continue reading