Hackers are actively exploiting the critical SessionReaper vulnerability (CVE-2025-54236) in Adobe Commerce (formerly Magento) platforms, with hundreds of attempts recorded.
The activity was spotted by e-commerce security firm Sansec, whose researchers previously described SessionReaper as one of the most severe security bugs in the history of the product.
Adobe warned about CVE-2025-54236 on September 8, saying that it is an improper input validation vulnerability that impacts Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 (and earlier).
An attacker successfully exploiting the flaw can take control of account sessions without any user interaction.
“A potential attacker could take over customer accounts in Adobe Commerce through the Commerce REST API,” Adobe explains.
Sansec previously stated that successful exploitation likely depends on storing session data on the file system, the default configuration used by most stores, and that a leaked hotfix from the vendor could provide clues on how it can be leveraged..
Roughly six weeks after the emergency patch for SessionReaper became available, Sansec is confirming active exploitation in the wild.
“Six weeks after Adobe’s emergency patch for SessionReaper (CVE-2025-54236), the vulnerability has entered active exploitation,” reads Sansec’s bulletin.
“Sansec Shield detected and blocked the first real-world attacks today, which is bad news for the thousands of stores that remain unpatched,” the researchers said.
Just today, Sansec blocked more than 250 SessionReaper exploitation attempts targeting multiple stores, most of the attacks originating from five IP addresses:
- 34.227.25.4
- 44.212.43.34
- 54.205.171.35
- 155.117.84.134
- 159.89.12.166
The attacks so far included PHP webshells or phpinfo probes that check configuration settings and look for predefined variables on the system.
Also today, researchers at Searchlight Cyber published a detailed technical analysis of CVE-2025-54236, which could lead to an increase in exploitation attempts.
According to Sansec, 62% of the Magento stores online have yet to install Adobe’s security update and remain vulnerable to SessionReaper attacks.
The researchers note that ten days after the fix became available, patch activity was so slow that only one in three websites installed the updates. Currently, 3 in 5 stores are vulnerable.
Website administrators are strongly advised to apply the patch or the recommended mitigations from Adobe as soon as possible.
46% of environments had passwords cracked, nearly doubling from 25% last year.
Get the Picus Blue Report 2025 now for a comprehensive look at more findings on prevention, detection, and data exfiltration trends.