How to find Adobe Commerce & Magento installations on your network

|
Updated

Latest Adobe Commerce & Magento vulnerability #

Adobe has disclosed an improper input validation vulnerability in the Commerce REST API, affecting certain versions of Adobe Commerce and Magento Open Source. Successful exploitation could allow a remote, unauthenticated adversary to take over another user's session. This vulnerability has been designated CVE-2025-54236 and has been rated critical with a CVSS score of 9.1.

Adobe's advisory describes the impact as a "security feature bypass" that could allow an adversary to take over users' accounts but does not mention additional risks such as remote code execution (RCE). However, the vulnerability researcher, Blaklis, posted that the security update patches "a pre-auth RCE and a customer ATO [account takeover]." Any RCE aspect of this vulnerability remains unconfirmed.

    The following versions are affected

    • Adobe Commerce versions prior to and including 2.4.4-p15
    • Adobe Commerce versions prior to and including 2.4.5-p14
    • Adobe Commerce versions prior to and including 2.4.6-p12
    • Adobe Commerce versions prior to and including 2.4.7-p7
    • Adobe Commerce versions prior to and including 2.4.8-p2
    • Adobe Commerce versions prior to and including 2.4.9-alpha2
    • Adobe Commerce B2B versions prior to and including 1.3.3-p15
    • Adobe Commerce B2B versions prior to and including 1.3.4-p14
    • Adobe Commerce B2B versions prior to and including 1.4.2-p7
    • Adobe Commerce B2B versions prior to and including 1.5.2-p2
    • Adobe Commerce B2B versions prior to and including 1.5.3-alpha2
    • Magento Open Source versions prior to and including 2.4.5-p14
    • Magento Open Source versions prior to and including 2.4.6-p12
    • Magento Open Source versions prior to and including 2.4.7-p7
    • Magento Open Source versions prior to and including 2.4.8-p2
    • Magento Open Source versions prior to and including 2.4.9-alpha2

    What is the impact? #

    Successful exploitation of the vulnerability would allow an adversary to take over another user's session, gaining control of their account.

    Are updates or workarounds available? #

    Users are encouraged to apply the VULN-32437-2-4-X-patch hotfix or upgrade to the latest security patch for all Adobe Commerce and Magento Open Source versions as quickly as possible.

      How to find potentially vulnerable systems with runZero #

      From the Software Inventory, use the following query to locate potentially impacted assets:

      vendor:=Adobe AND product:=Magento AND (version:>0 AND version:<="2.4.9-alpha2")

      Written by Matthew Kienow

      Matthew Kienow is a software engineer and security researcher. Matthew previously worked on the Recog recognition framework, AttackerKB as well as Metasploit's MSF 5 APIs. He has also designed, built, and successfully deployed many secure software solutions; however, often he enjoys breaking them instead. He has presented his research at various security conferences including DerbyCon, Hack In Paris, and CarolinaCon. His research has been cited by CSO, Threatpost and SC Magazine.

      More about Matthew Kienow
      Subscribe Now

      Get the latest news and expert insights delivered in your inbox.

      Welcome to the club! Your subscription to our newsletter is successful.

      See Results in Minutes

      See & secure your total attack surface. Even the unknowns & unmanageable.