CVE entry · CVE-2025-54236
CVE-2025-54236: Adobe Commerce and Magento Improper Input Validation Vulnerability
Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API.
- Actively exploited: added to CISA’s KEV catalog on October 24, 2025.
- Use by ransomware: not established so far.
- Remediation deadline for US federal agencies: November 14, 2025.
Description from CISA’s KEV catalog.
What to do
- Check whether your estate includes Adobe Commerce and Magento, including internet-facing devices.
- Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
- An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.
References
- Vendor advisory or reference cited by CISA (experienceleague.adobe.com)
- NVD entry (NIST)
- CISA KEV catalog
Other Adobe vulnerabilities
-
Adobe Commerce and Magento Incorrect Authorization Vulnerability
-
Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
-
Adobe ColdFusion Path Traversal Vulnerability
-
Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
-
Adobe Acrobat and Reader Prototype Pollution Vulnerability
-
Adobe Acrobat Use-After-Free Vulnerability