erroneo.us
Search all guides⌘K

Security Digest · Sep 9, 2025 · Vulnerability · Web framework

Magento SessionReaper CVE-2025-54236: Mass-Exploited RCE

SessionReaper hit Adobe Commerce and Magento stores from Oct 2025 via the REST API. Hotfix VULN-32437 fixes it; scan for backdoors and patch the 2026 KEV bugs.

Published By erroneo.us Security Desk · Updated 3 min read8 sources

Our verdict

Check exposure

Patched since September 2025, but SessionReaper probes reached most Magento stores and Sansec estimated one in six was backdoored; confirm the fix, scan any store that patched late, and make sure you are also fixed for the 2026 Magento KEV bugs.

Who must act: Merchants, agencies and hosts running Adobe Commerce, Commerce B2B or Magento Open Source that applied the VULN-32437 hotfix after October 22, 2025 or never applied it, and anyone not yet current for the 2026 Magento KEV fixes.

Who can relax: Stores on hosted SaaS platforms with no Magento code, and stores that patched in September 2025, are current today and have had a clean malware scan since.

Affected
Adobe Commerce 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier
Adobe Commerce B2B 1.5.3-alpha2, 1.5.2-p2, 1.4.2-p7, 1.3.4-p14, 1.3.3-p15 and earlier
Magento Open Source 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14 and earlier
Custom Attributes Serializable module 0.1.0 to 0.3.0 (Adobe lists up to 0.4.0)
Fixed in
Hotfix VULN-32437-2-4-X-patch (APSB25-88, Sep 9, 2025)
October 2025 security releases (APSB25-94) include the fix, per Sansec
Custom Attributes Serializable module 0.4.0 or later
Still needed today: the 2026-aug releases for CVE-2026-71362 and Adobe's hotfix for CVE-2026-75650
CVSS
9.1 (v3.1, vendor)
EPSS
94.7% (percentile 99.9)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. List every Magento and Adobe Commerce install, including staging and regional stores, and record the release with bin/magento --version.
  2. Confirm the SessionReaper fix is present, either the VULN-32437 hotfix or an October 2025 or later release.
  3. Bring every store up to the fixes for the 2026 KEV bugs CVE-2026-71362 and CVE-2026-75650; the 2025 fix alone leaves you exposed.
  4. Scan any store that was unpatched after October 22, 2025 for backdoors, and clean malicious session files from pub/media/customer_address.
  5. If you find compromise, rotate the crypt key, reset admin passwords and delete unknown API integrations; key rotation alone does not revoke API tokens.

How to check if you are affected or compromised

  • grep -rlE 'FileCookieJar|SyslogUdpHandler' pub/media/customer_address to find serialized session payloads Sansec saw in attacks.
  • Look for backdoors named static.php, bootstrap.php, sysapi.php or gsfa1faewf.txt, and for changes to pub/errors/404.php.
  • Search web logs for requests to /customer/address_file/upload and for traffic from Sansec's listed IPs, such as 45.32.66.51 and 149.28.33.250.
  • Check outbound connections and code for the payload hosts sagecrafft.com, worcksbot.com and tecnokauf.ru.

What happened#

On September 9, 2025, Adobe released bulletin APSB25-88 and hotfix VULN-32437-2-4-X-patch for CVE-2025-54236, an improper input validation flaw (CWE-20) in Adobe Commerce and Magento Open Source. Adobe's knowledge base article says an attacker "could take over customer accounts in Adobe Commerce through the Commerce REST API." The CVE record scores it CVSS 3.1 9.1, with no login and no user interaction needed. Adobe added WAF rules for its cloud customers.

Sansec named the bug SessionReaper and said Adobe downplayed the urgency by not mentioning that attackers could take over the server. The fix leaked by accident on August 22, and Adobe first rated it priority 2, meaning patch within 30 days. On October 22, Searchlight Cyber published the root cause. It credits the researcher Blaklis with the find. Magento's ServiceInputProcessor built nested objects from REST input, so an attacker could reach session-handling code. Combined with an unauthenticated upload at /customer/address_file/upload, that gives remote code execution on stores that keep sessions in files. Searchlight says Redis-backed stores "may also be vulnerable," though its payload does not work there.

Sansec saw the first attacks the same day. By October 23 only 38% of stores were patched. CISA added the CVE to the KEV catalog on October 24, the day Adobe raised the priority to 1. Sansec says attacks hit 49% of stores by October 26 and estimated that 16 to 18% then had at least one backdoor. By November 1, 81% had been probed. Payloads included PHP web shells, uploaders and scripts that sent admin usernames and recent sales data to outside servers.

Who is affected#

Adobe Commerce 2.4.4-p15, 2.4.5-p14, 2.4.6-p12, 2.4.7-p7, 2.4.8-p2 and 2.4.9-alpha2 and earlier; Magento Open Source 2.4.5-p14, 2.4.6-p12, 2.4.7-p7, 2.4.8-p2 and 2.4.9-alpha2 and earlier; Commerce B2B 1.5.3-alpha2 and earlier; and the Custom Attributes Serializable module, which Adobe says to update to 0.4.0 or later. NVD lists the same lines. Sansec says Adobe's fix did not close the arbitrary upload, so a WAF or upload block still adds value.

Do you really need to act?#

Yes, but this is now a check, not a fire drill. A store that is still unpatched today should be assumed compromised. The bigger point: Magento has had two more KEV bugs since. CVE-2026-75650 (StyleSmuggler) is a template-injection code execution flaw scored 10.0, added to KEV on September 8, 2026. CVE-2026-71362 is an incorrect-authorization flaw fixed in the 2026-aug releases and added on September 24, 2026. Being patched for SessionReaper is not enough. Before it came CosmicSting (CVE-2024-34102), in KEV since July 2024.

What to do now#

  1. Run bin/magento --version on every store, including staging.
  2. Confirm the fix. The patched vendor/magento/framework/Webapi/ServiceInputProcessor.php should contain the comment "Allow only simple types or Api Data Objects".
  3. Apply the current Adobe releases and hotfixes for CVE-2026-71362 and CVE-2026-75650.
  4. If the module is installed, run composer require magento/out-of-process-custom-attributes=0.4.0 --with-dependencies.
  5. Block uploads to pub/media/customer_address or put a WAF in front, as Sansec advises.

How to tell if you were hit#

From the Magento root, run grep -rlE 'FileCookieJar|SyslogUdpHandler' pub/media/customer_address. Sansec found those classes in malicious session files. Look for static.php, bootstrap.php, sysapi.php and gsfa1faewf.txt, and diff pub/errors/404.php against a clean copy. Search access logs for /customer/address_file/upload and for Sansec's listed IPs, such as 45.32.66.51, 45.143.20.147 and 149.28.33.250. If you find anything, rotate the crypt key, reset admin passwords and delete unknown API integrations.

Timeline#

  • — Adobe accidentally leaks the fix, per Sansec.
  • — APSB25-88 and hotfix VULN-32437 are released.
  • — APSB25-94 rolls the fix into regular releases.
  • — Searchlight Cyber publishes its analysis, and attacks begin.
  • — CISA adds the CVE to KEV, with a November 14 deadline.
  • — CVE-2026-75650 joins KEV. CVE-2026-71362 follows on September 24.

Vulnerability records

  • CVE-2025-54236 · KEV 2025-10-24 · Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Adobe Experience League — Action Required: Critical Security Update Available for Adobe Commerce (APSB25-88) experienceleague.adobe.com
  2. CVE record — CVE-2025-54236 cve.org
  3. NVD — CVE-2025-54236 nvd.nist.gov
  4. CISA — Known Exploited Vulnerabilities: CVE-2025-54236 cisa.gov
  5. Sansec — SessionReaper (CVE-2025-54236) sansec.io
  6. Searchlight Cyber — Why nested deserialization is still harmful: Magento RCE (CVE-2025-54236) slcyber.io
  7. CVE record — CVE-2026-71362 cve.org
  8. CVE record — CVE-2026-75650 cve.org