Adobe Commerce SessionReaper exploitation and emergency remediation

The **SessionReaper** flaw in **Adobe Commerce** is an actively exploited **CVE-2025-54236** vulnerability that can lead to **customer account takeover** and **account session control**. Adobe identified the bug as an **improper input validation** issue, and the attack path runs through the **Commerce REST API**. The issue affects **2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 (and earlier)**, while Sansec said **more than 250** attempts were blocked against multiple stores. The **security update** is available, but many stores remain **unpatched**.

**Adobe Commerce** is seeing an **active exploitation wave** for **CVE-2025-54236 / SessionReaper**, with **hundreds of attempts** hitting **multiple stores** and many deployments still **unpatched**. The attacks matter because the flaw can let an attacker **take control of account sessions** without user interaction. **Sansec** says it has already **detected and blocked** the first real-world attacks.

Adobe urged **Adobe Commerce** and **Magento Open Source** administrators to **test and deploy the available patch immediately** for **CVE-2025-54236**, reducing the risk of unauthenticated abuse of the **Commerce REST API**. The advisory centers on the **SessionReaper** flaw, which researchers describe as one of the platform's most severe issues. **Adobe Commerce on Cloud** customers had a temporary **WAF rule** in place while remediation moved forward.

**Adobe** issued an **emergency update** for **Adobe Commerce** and **Magento open source** to fix **CVE-2025-54236**, an improper input validation flaw that could enable remote session takeover. The patch, disclosed on **Sept. 9**, addressed a high-impact weakness in the e-commerce platform stack. Administrators should treat the release as urgent because the flaw was later confirmed as **exploited in the wild**.