---
title: "Magento SessionReaper CVE-2025-54236: Mass-Exploited RCE"
url: https://erroneo.us/security/briefs/adobe-commerce-magento-sessionreaper-cve-2025-54236/
description: "SessionReaper hit Adobe Commerce and Magento stores from Oct 2025 via the REST API. Hotfix VULN-32437 fixes it; scan for backdoors and patch the 2026 KEV bugs."
type: security-brief
section: "Security Digest"
date_published: 2025-09-09
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-54236"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Magento SessionReaper CVE-2025-54236: Mass-Exploited RCE

**Verdict: Check exposure.** Patched since September 2025, but SessionReaper probes reached most Magento stores and Sansec estimated one in six was backdoored; confirm the fix, scan any store that patched late, and make sure you are also fixed for the 2026 Magento KEV bugs.

- **Who must act:** Merchants, agencies and hosts running Adobe Commerce, Commerce B2B or Magento Open Source that applied the VULN-32437 hotfix after October 22, 2025 or never applied it, and anyone not yet current for the 2026 Magento KEV fixes.
- **Who can relax:** Stores on hosted SaaS platforms with no Magento code, and stores that patched in September 2025, are current today and have had a clean malware scan since.
- **Affected:** Adobe Commerce 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier; Adobe Commerce B2B 1.5.3-alpha2, 1.5.2-p2, 1.4.2-p7, 1.3.4-p14, 1.3.3-p15 and earlier; Magento Open Source 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14 and earlier; Custom Attributes Serializable module 0.1.0 to 0.3.0 (Adobe lists up to 0.4.0)
- **Fixed:** Hotfix VULN-32437-2-4-X-patch (APSB25-88, Sep 9, 2025); October 2025 security releases (APSB25-94) include the fix, per Sansec; Custom Attributes Serializable module 0.4.0 or later; Still needed today: the 2026-aug releases for CVE-2026-71362 and Adobe's hotfix for CVE-2026-75650
- **CVEs:** CVE-2025-54236
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. List every Magento and Adobe Commerce install, including staging and regional stores, and record the release with bin/magento --version.
2. Confirm the SessionReaper fix is present, either the VULN-32437 hotfix or an October 2025 or later release.
3. Bring every store up to the fixes for the 2026 KEV bugs CVE-2026-71362 and CVE-2026-75650; the 2025 fix alone leaves you exposed.
4. Scan any store that was unpatched after October 22, 2025 for backdoors, and clean malicious session files from pub/media/customer_address.
5. If you find compromise, rotate the crypt key, reset admin passwords and delete unknown API integrations; key rotation alone does not revoke API tokens.

### How to check if you are affected

- grep -rlE 'FileCookieJar|SyslogUdpHandler' pub/media/customer_address to find serialized session payloads Sansec saw in attacks.
- Look for backdoors named static.php, bootstrap.php, sysapi.php or gsfa1faewf.txt, and for changes to pub/errors/404.php.
- Search web logs for requests to /customer/address_file/upload and for traffic from Sansec's listed IPs, such as 45.32.66.51 and 149.28.33.250.
- Check outbound connections and code for the payload hosts sagecrafft.com, worcksbot.com and tecnokauf.ru.

## What happened

On September 9, 2025, Adobe released bulletin APSB25-88 and hotfix `VULN-32437-2-4-X-patch` for CVE-2025-54236, an improper input validation flaw (CWE-20) in Adobe Commerce and Magento Open Source. Adobe's [knowledge base article](https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-27397) says an attacker "could take over customer accounts in Adobe Commerce through the Commerce REST API." The [CVE record](https://www.cve.org/CVERecord?id=CVE-2025-54236) scores it CVSS 3.1 9.1, with no login and no user interaction needed. Adobe added WAF rules for its cloud customers.

[Sansec](https://sansec.io/research/sessionreaper) named the bug SessionReaper and said Adobe downplayed the urgency by not mentioning that attackers could take over the server. The fix leaked by accident on August 22, and Adobe first rated it priority 2, meaning patch within 30 days. On October 22, [Searchlight Cyber](https://slcyber.io/research-center/why-nested-deserialization-is-still-harmful-magento-rce-cve-2025-54236/) published the root cause. It credits the researcher Blaklis with the find. Magento's `ServiceInputProcessor` built nested objects from REST input, so an attacker could reach session-handling code. Combined with an unauthenticated upload at `/customer/address_file/upload`, that gives remote code execution on stores that keep sessions in files. Searchlight says Redis-backed stores "may also be vulnerable," though its payload does not work there.

Sansec saw the first attacks the same day. By October 23 only 38% of stores were patched. CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54236) on October 24, the day Adobe raised the priority to 1. Sansec says attacks hit 49% of stores by October 26 and estimated that 16 to 18% then had at least one backdoor. By November 1, 81% had been probed. Payloads included PHP web shells, uploaders and scripts that sent admin usernames and recent sales data to outside servers.

## Who is affected

Adobe Commerce 2.4.4-p15, 2.4.5-p14, 2.4.6-p12, 2.4.7-p7, 2.4.8-p2 and 2.4.9-alpha2 and earlier; Magento Open Source 2.4.5-p14, 2.4.6-p12, 2.4.7-p7, 2.4.8-p2 and 2.4.9-alpha2 and earlier; Commerce B2B 1.5.3-alpha2 and earlier; and the Custom Attributes Serializable module, which Adobe says to update to 0.4.0 or later. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-54236) lists the same lines. Sansec says Adobe's fix did not close the arbitrary upload, so a WAF or upload block still adds value.

## Do you really need to act?

Yes, but this is now a check, not a fire drill. A store that is still unpatched today should be assumed compromised. The bigger point: Magento has had two more KEV bugs since. [CVE-2026-75650](https://www.cve.org/CVERecord?id=CVE-2026-75650) (StyleSmuggler) is a template-injection code execution flaw scored 10.0, added to KEV on September 8, 2026. [CVE-2026-71362](https://www.cve.org/CVERecord?id=CVE-2026-71362) is an incorrect-authorization flaw fixed in the 2026-aug releases and added on September 24, 2026. Being patched for SessionReaper is not enough. Before it came CosmicSting (CVE-2024-34102), in KEV since July 2024.

## What to do now

1. Run `bin/magento --version` on every store, including staging.
2. Confirm the fix. The patched `vendor/magento/framework/Webapi/ServiceInputProcessor.php` should contain the comment "Allow only simple types or Api Data Objects".
3. Apply the current Adobe releases and hotfixes for CVE-2026-71362 and CVE-2026-75650.
4. If the module is installed, run `composer require magento/out-of-process-custom-attributes=0.4.0 --with-dependencies`.
5. Block uploads to `pub/media/customer_address` or put a WAF in front, as Sansec advises.

## How to tell if you were hit

From the Magento root, run `grep -rlE 'FileCookieJar|SyslogUdpHandler' pub/media/customer_address`. Sansec found those classes in malicious session files. Look for `static.php`, `bootstrap.php`, `sysapi.php` and `gsfa1faewf.txt`, and diff `pub/errors/404.php` against a clean copy. Search access logs for `/customer/address_file/upload` and for Sansec's listed IPs, such as `45.32.66.51`, `45.143.20.147` and `149.28.33.250`. If you find anything, rotate the crypt key, reset admin passwords and delete unknown API integrations.

## Timeline

- Aug 22, 2025 — Adobe accidentally leaks the fix, per Sansec.
- Sep 9, 2025 — APSB25-88 and hotfix VULN-32437 are released.
- Oct 14, 2025 — APSB25-94 rolls the fix into regular releases.
- Oct 22, 2025 — Searchlight Cyber publishes its analysis, and attacks begin.
- Oct 24, 2025 — CISA adds the CVE to KEV, with a November 14 deadline.
- Sep 8, 2026 — CVE-2026-75650 joins KEV. CVE-2026-71362 follows on September 24.

## Sources

1. [Adobe Experience League — Action Required: Critical Security Update Available for Adobe Commerce (APSB25-88)](https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-27397)
2. [CVE record — CVE-2025-54236](https://www.cve.org/CVERecord?id=CVE-2025-54236)
3. [NVD — CVE-2025-54236](https://nvd.nist.gov/vuln/detail/CVE-2025-54236)
4. [CISA — Known Exploited Vulnerabilities: CVE-2025-54236](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54236)
5. [Sansec — SessionReaper (CVE-2025-54236)](https://sansec.io/research/sessionreaper)
6. [Searchlight Cyber — Why nested deserialization is still harmful: Magento RCE (CVE-2025-54236)](https://slcyber.io/research-center/why-nested-deserialization-is-still-harmful-magento-rce-cve-2025-54236/)
7. [CVE record — CVE-2026-71362](https://www.cve.org/CVERecord?id=CVE-2026-71362)
8. [CVE record — CVE-2026-75650](https://www.cve.org/CVERecord?id=CVE-2026-75650)

---
Source page: https://erroneo.us/security/briefs/adobe-commerce-magento-sessionreaper-cve-2025-54236/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt