CVE-2025-54236

Name of the Vulnerable Software and Affected Versions Adobe Commerce versions prior to 2.4.9-alpha2

Description Adobe Commerce and Magento Open Source are affected by an improper input validation flaw in the Custom Attributes Serializable module. This issue allows a remote attacker to bypass security features and achieve session takeover without user interaction by capturing and reusing session tokens. In environments using file-based session storage, an attacker can inject a malicious serialized payload, leading to remote code execution (RCE) with the permissions of the web server. This vulnerability has been actively exploited in the wild, with over 1,000 APIs targeted and 216 websites fully compromised, granting attackers root access and allowing the deployment of PHP web shells. The exploitation process involves targeting the Commerce REST API to execute commands and extract sensitive system files, such as user account listings.

Recommendations Update Adobe Commerce to version 2.4.9-alpha2 or later. Upgrade the Custom Attributes Serializable module to version 0.4.0 or higher. As a temporary mitigation, disable file-based session storage to limit exposure to remote code execution.