CISA KEV · Known exploitedCritical

CVE-2025-54236

Adobe Commerce and Magento

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.

CVSS: 9.1
EPSS: 96.7%
CISA KEV: Listed
Published: 2025.09.09

PRIORITY ASSESSMENT

Immediate review

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV

Exploit probability96.7%

Technical severityCVSS 9.1

Vulnerability overview

Affected product and versions

Product: Adobe Commerce and Magento
Affected versions: 2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8, 2.4.9, 1.3.3, 1.3.4, 1.4.2, 1.5.2, 1.5.3
Fixed versions: No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Due date: 2025.11.14

1
Identify
Confirm that Adobe Commerce and Magento and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE: CWE-20
KEV added: 2025.10.24
Ransomware use: 미확인