← All articles

Vulnerabilities · 2026-06-30

SessionReaper (CVE-2025-54236): Unauthenticated RCE in Magento

SessionReaper (CVE-2025-54236) is a critical (CVSS 9.1) flaw in Magento and Adobe Commerce that allows customer account takeover and, under certain conditions, unauthenticated remote code execution through the Commerce Web API. Adobe shipped an emergency patch (APSB25-88) and the regular fix in APSB25-94 — and attackers moved fast.

Check your exposure in seconds: run a free MageArgus scan to compare your version against SessionReaper's fixed patch level.

By the numbers
  • CVSS 9.1 — critical; emergency hotfix released — Adobe APSB25-88 / APSB25-94
  • Hotfix ID VULN-32437 applies on top of any current version — Adobe security bulletin

What SessionReaper is

Improper input validation in the Web API's nested input processing lets an attacker manipulate sessions to take over customer accounts, and in vulnerable configurations execute code without authentication. It's the kind of bug that gets mass-exploited because it needs no login.

Affected and exact fixed versions

You're exposed if you're below your branch's fix. The fixed levels (APSB25-94) are:

Note: a store on 2.4.7-p7 is still vulnerable — the fix is p8.

Fix it now — hotfix or upgrade

For speed, apply Adobe's isolated hotfix (VULN-32437) on your current version, then plan the patch-level update:

# fastest: apply the isolated hotfix
patch -p1 < VULN-32437-2-4-X-patch
bin/magento cache:flush

# or move to the fixed patch on your branch
composer require magento/product-community-edition=<branch-fix> --no-update
composer update --with-dependencies
bin/magento setup:upgrade && bin/magento cache:flush

See the patching guide for safe steps.

If you were already exposed

Because it enables account takeover, check for fraudulent orders, rogue admin users and unexpected sessions/tokens after the exposure window. Rotate admin passwords and integration tokens, and review the other actively-exploited CVEs while you're at it.

Frequently asked questions

I'm on 2.4.7-p7 — am I patched against SessionReaper?

No. The 2.4.7 fix is 2.4.7-p8 (APSB25-94). p7 is the last affected level — upgrade to p8 or apply the VULN-32437 hotfix.

Hotfix or full patch update?

The isolated hotfix closes the hole immediately on your current version. Follow up with the patch-level update (p8/p13/etc.) so you also get every other fix.

Related reading

Scan your store free →