CVE-2025-54236

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.

• CWE-20

• https://helpx.adobe.com/security/products/magento/apsb25-88.htmlVendor Advisory
• https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-27397Vendor Advisory
• https://nullsecurityx.codes/cve-2025-54236-sessionreaper-unauthenticated-rce-in-magentoBroken Link, Exploit, Third Party Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54236US Government Resource

Published

Sep 9, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-54230Adobe Framemaker versions 2020.8, 2022.6 and earlier are aff…7.8
• CVE-2025-54231Adobe Framemaker versions 2020.8, 2022.6 and earlier are aff…7.8
• CVE-2025-54232Adobe Framemaker versions 2020.8, 2022.6 and earlier are aff…7.8
• CVE-2025-54233Adobe Framemaker versions 2020.8, 2022.6 and earlier are aff…5.5
• CVE-2025-54234ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are…2.7
• CVE-2025-54235Substance3D - Modeler versions 1.22.0 and earlier are affect…5.5
• CVE-2025-54237Substance3D - Stager versions 3.1.3 and earlier are affected…5.5
• CVE-2025-54238Dimension versions 4.1.3 and earlier are affected by an out-…5.5
• CVE-2025-54239After Effects versions 25.3, 24.6.7 and earlier are affected…5.5
• CVE-2025-5424A vulnerability was found in juzaweb CMS up to 3.4.2 and cla…6.3
• CVE-2025-54240After Effects versions 25.3, 24.6.7 and earlier are affected…5.5
• CVE-2025-54241After Effects versions 25.3, 24.6.7 and earlier are affected…5.5