Incident : Vulnerability Exploitation

ADO0402304102325

Exposure Impact

Title: Active Exploitation of SessionReaper Vulnerability (CVE-2025-54236) in Adobe Commerce (Magento)

Description: Hackers are actively exploiting the critical SessionReaper vulnerability (CVE-2025-54236) in Adobe Commerce (formerly Magento) platforms, with hundreds of attempts recorded. The flaw, an improper input validation issue, allows attackers to take control of account sessions without user interaction via the Commerce REST API. Sansec detected and blocked over 250 exploitation attempts from five IP addresses, primarily deploying PHP webshells or phpinfo probes. As of the report, 62% of Magento stores remain unpatched and vulnerable.

Date Detected: 2025-09-08

Date Publicly Disclosed: 2025-09-08

Type: Vulnerability Exploitation

Attack Vector: Network-BasedExploitation of Public-Facing Application (CVE-2025-54236)REST API Abuse

Vulnerability Exploited: CVE-2025-54236 (Improper Input Validation in Adobe Commerce/Magento)

Motivation: OpportunisticFinancial Gain (Potential)Data Theft

Incident : Vulnerability Exploitation

ADO5132051102325

Exposure Impact

Title: Exploitation Attempts Targeting CVE-2025-54236 (SessionReaper) in Adobe Commerce and Magento Open Source

Description: Attackers are exploiting CVE-2025-54236, a critical 'Improper Input Validation' vulnerability (dubbed 'SessionReaper') in Adobe Commerce and Magento Open Source. The flaw may allow attackers to take over customer accounts or achieve unauthenticated remote code execution (RCE) under certain conditions (e.g., file-based session storage). Over 250 exploitation attempts were blocked on Wednesday, with expectations of mass exploitation within 48 hours due to public exploit details. Only 38% of Magento stores are patched, leaving a majority vulnerable. Attack payloads include PHP webshells and phpinfo probes.

Date Detected: 2025-09-11

Date Publicly Disclosed: 2025-09-11

Type: Vulnerability Exploitation

Attack Vector: Network-BasedExploitation of Public-Facing Application

Vulnerability Exploited: Cve Id: CVE-2025-54236, Name: SessionReaper, Type: Improper Input Validation, Cvss Score: None, Affected Versions: {'Adobe Commerce/Magento Open Source': ['2.4.9-alpha2 and earlier', '2.4.8-p2 and earlier', '2.4.7-p7 and earlier', '2.4.6-p12 and earlier', '2.4.5-p14 and earlier', '2.4.4-p15 and earlier'], 'Adobe Commerce B2B': ['1.5.3-alpha2 and earlier', '1.5.2-p2 and earlier', '1.4.2-p7 and earlier', '1.3.4-p14 and earlier', '1.3.3-p15 and earlier']}, Patch Available: True, Patch Release Date: 2025-09-09, Patch Leaked Prior: True, Exploit Publicly Available: True.

Motivation: OpportunisticFinancial Gain (Potential)Data Theft (Potential)Unauthorized Access

Incident : Vulnerability Exploitation

ADO0092800102325

Exposure Impact

Title: Exploitation of CVE-2025-54236 (SessionReaper) in Adobe Commerce and Magento Open Source Platforms

Description: Threat actors are exploiting a critical improper input validation flaw (CVE-2025-54236, CVSS score: 9.1) in Adobe Commerce and Magento Open Source platforms to take over customer accounts via the Commerce REST API. Over 250 attack attempts have been recorded in the past 24 hours, with 62% of Magento stores remaining vulnerable six weeks after patch disclosure. Attacks involve dropping PHP webshells or probing phpinfo to extract PHP configuration. The vulnerability, dubbed 'SessionReaper,' was responsibly disclosed by researcher Blaklis and patched by Adobe last month. Exploitation is now confirmed in-the-wild, with IP addresses linked to malicious activity. A related deserialization flaw, CosmicSting (CVE-2024-34102), was widely exploited in July 2024.

Type: Vulnerability Exploitation

Attack Vector: Improper Input ValidationDeserialization FlawREST API ExploitationPHP Webshell Deployment

Vulnerability Exploited: CVE-2025-54236 (SessionReaper)CVE-2024-34102 (CosmicSting)

Threat Actor: Unknown

Motivation: Unauthorized AccessData TheftPotential Financial GainReconnaissance

Incident : Vulnerability Exploitation ADO0402304102325

Entity Name: Adobe Commerce (Magento) Users

Entity Type: E-Commerce Platforms, Online Stores

Industry: Retail/E-Commerce

Location: Global

Incident : Vulnerability Exploitation ADO5132051102325

Entity Name: Adobe (Adobe Commerce)

Entity Type: Software Vendor

Industry: Technology

Location: Global

Size: Large Enterprise

Incident : Vulnerability Exploitation ADO5132051102325

Entity Name: Multiple Magento Open Source Users

Entity Type: E-commerce Businesses, Online Retailers

Industry: Retail

Location: Global

Size: ['SMB', 'Enterprise']

Customers Affected: Potentially all unpatched stores (62% as of report)

Incident : Vulnerability Exploitation ADO0092800102325

Entity Name: Adobe Commerce Users

Entity Type: E-commerce Platform

Industry: Retail/E-commerce

Location: Global

Incident : Vulnerability Exploitation ADO0092800102325

Entity Name: Magento Open Source Users

Entity Type: E-commerce Platform

Industry: Retail/E-commerce

Location: Global

Incident : Vulnerability Exploitation ADO0402304102325

Incident Response Plan Activated: ['Sansec Shield Detection/Blocking']

Third Party Assistance: Sansec (Detection/Analysis), Searchlight Cyber (Technical Analysis).

Containment Measures: Blocking Exploitation Attempts (Sansec Shield)Patching Vulnerability (Recommended)

Remediation Measures: Apply Adobe Security UpdateMitigations per Adobe Advisory

Communication Strategy: Public Advisory by Adobe (2025-09-08)Sansec BulletinSearchlight Cyber Technical Analysis

Enhanced Monitoring: Sansec Shield (Ongoing Detection)

Incident : Vulnerability Exploitation ADO5132051102325

Incident Response Plan Activated: True

Third Party Assistance: Sansec, Assetnote/Searchlight Cyber.

Containment Measures: Blocking Exploit Attempts (250+ blocked)IP Blacklisting

Remediation Measures: Apply Adobe Hotfix (released 2025-09-09)Upgrade to Latest Secure VersionScan for Signs of Compromise

Communication Strategy: Public Advisory by SansecTechnical Deep-Dive by AssetnoteUrgent Patching Recommendations

Enhanced Monitoring: Monitor for Exploitation AttemptsScan for Webshells/phpinfo Probes

Incident : Vulnerability Exploitation ADO0092800102325

Third Party Assistance: Sansec (Warning & Analysis), Searchlight Cyber (Technical Analysis).

Containment Measures: Urgent Patch Application Recommended

Remediation Measures: Apply Adobe Security UpdatesMonitor for PHP WebshellsRestrict Access to '/customer/address_file/upload'

Communication Strategy: Public Advisory by SansecRevised Adobe Security Bulletin

Enhanced Monitoring: Monitor for Attacks from Known Malicious IPs

Incident : Vulnerability Exploitation ADO0402304102325

Type of Data Compromised: Session data (potential), Customer account access (if exploited)

Sensitivity of Data: High (If Sessions Include PII or Payment Data)

Data Exfiltration: Potential (Via PHP Webshells or Probes)

Personally Identifiable Information: Potential (If Session Data Includes PII)

Incident : Vulnerability Exploitation ADO5132051102325

Type of Data Compromised: Potential: customer account credentials, Session data, Sensitive information (if rce achieved)

Sensitivity of Data: High (if PII or payment data accessed)

Data Exfiltration: Potential (if RCE achieved)

File Types Exposed: Potential: PHP files (webshells)Session filesDatabase dumps (if RCE)

Personally Identifiable Information: Potential (if customer accounts compromised)

Incident : Vulnerability Exploitation ADO0092800102325

Type of Data Compromised: Customer account credentials (potential)

Sensitivity of Data: High (Account Takeover Risk)

Data Exfiltration: PHP Configuration Information (via phpinfo Probing)

File Types Exposed: PHP Webshells

Personally Identifiable Information: Potential (If Accounts Compromised)

Incident : Vulnerability Exploitation ADO5132051102325

Regulatory Notifications: Potential GDPR/CCPA Notifications if PII Breached

Incident : Vulnerability Exploitation ADO0402304102325

Lessons Learned: Critical vulnerabilities in widely used e-commerce platforms can lead to rapid, large-scale exploitation if left unpatched., Default configurations (e.g., file-system session storage) can exacerbate risk., Slow patch adoption (62% unpatched after 6 weeks) highlights the need for automated update mechanisms or stricter enforcement.

Incident : Vulnerability Exploitation ADO5132051102325

Lessons Learned: Critical vulnerabilities in widely-used e-commerce platforms are prime targets for mass exploitation., Delayed patching significantly increases risk (only 38% patched at time of attacks)., Public disclosure of exploit details accelerates attacker activity (mass exploitation expected within 48 hours)., File-based session storage introduces higher risk of RCE in this vulnerability.

Incident : Vulnerability Exploitation ADO0092800102325

Lessons Learned: Delayed patching increases exploitation risk, as seen with 62% of Magento stores remaining vulnerable six weeks post-disclosure., Deserialization flaws in e-commerce platforms are high-value targets for threat actors, requiring prioritized remediation., Public PoC exploits accelerate attack timelines, necessitating proactive monitoring and defense-in-depth strategies.

Incident : Vulnerability Exploitation ADO0402304102325

Recommendations: Immediately apply Adobe's security patch for CVE-2025-54236., Audit session storage configurations; avoid file-system storage if possible., Deploy WAF rules or intrusion detection (e.g., Sansec Shield) to block exploitation attempts., Monitor for unusual REST API activity or PHP webshell artifacts., Educate customers on recognizing unauthorized account access.Immediately apply Adobe's security patch for CVE-2025-54236., Audit session storage configurations; avoid file-system storage if possible., Deploy WAF rules or intrusion detection (e.g., Sansec Shield) to block exploitation attempts., Monitor for unusual REST API activity or PHP webshell artifacts., Educate customers on recognizing unauthorized account access.Immediately apply Adobe's security patch for CVE-2025-54236., Audit session storage configurations; avoid file-system storage if possible., Deploy WAF rules or intrusion detection (e.g., Sansec Shield) to block exploitation attempts., Monitor for unusual REST API activity or PHP webshell artifacts., Educate customers on recognizing unauthorized account access.Immediately apply Adobe's security patch for CVE-2025-54236., Audit session storage configurations; avoid file-system storage if possible., Deploy WAF rules or intrusion detection (e.g., Sansec Shield) to block exploitation attempts., Monitor for unusual REST API activity or PHP webshell artifacts., Educate customers on recognizing unauthorized account access.Immediately apply Adobe's security patch for CVE-2025-54236., Audit session storage configurations; avoid file-system storage if possible., Deploy WAF rules or intrusion detection (e.g., Sansec Shield) to block exploitation attempts., Monitor for unusual REST API activity or PHP webshell artifacts., Educate customers on recognizing unauthorized account access.

Incident : Vulnerability Exploitation ADO5132051102325

Recommendations: Immediately apply the Adobe hotfix or upgrade to the latest secure version of Adobe Commerce/Magento Open Source., Audit session storage configurations (prioritize moving away from file-based storage if possible)., Monitor for indicators of compromise (e.g., PHP webshells, unusual phpinfo requests)., Block known malicious IPs associated with exploitation attempts (shared by Sansec)., Enable WAF rules to detect and block SessionReaper exploitation patterns., Conduct a thorough review of customer accounts for signs of unauthorized access., Educate customers on phishing risks, as compromised accounts may be used for further attacks.Immediately apply the Adobe hotfix or upgrade to the latest secure version of Adobe Commerce/Magento Open Source., Audit session storage configurations (prioritize moving away from file-based storage if possible)., Monitor for indicators of compromise (e.g., PHP webshells, unusual phpinfo requests)., Block known malicious IPs associated with exploitation attempts (shared by Sansec)., Enable WAF rules to detect and block SessionReaper exploitation patterns., Conduct a thorough review of customer accounts for signs of unauthorized access., Educate customers on phishing risks, as compromised accounts may be used for further attacks.Immediately apply the Adobe hotfix or upgrade to the latest secure version of Adobe Commerce/Magento Open Source., Audit session storage configurations (prioritize moving away from file-based storage if possible)., Monitor for indicators of compromise (e.g., PHP webshells, unusual phpinfo requests)., Block known malicious IPs associated with exploitation attempts (shared by Sansec)., Enable WAF rules to detect and block SessionReaper exploitation patterns., Conduct a thorough review of customer accounts for signs of unauthorized access., Educate customers on phishing risks, as compromised accounts may be used for further attacks.Immediately apply the Adobe hotfix or upgrade to the latest secure version of Adobe Commerce/Magento Open Source., Audit session storage configurations (prioritize moving away from file-based storage if possible)., Monitor for indicators of compromise (e.g., PHP webshells, unusual phpinfo requests)., Block known malicious IPs associated with exploitation attempts (shared by Sansec)., Enable WAF rules to detect and block SessionReaper exploitation patterns., Conduct a thorough review of customer accounts for signs of unauthorized access., Educate customers on phishing risks, as compromised accounts may be used for further attacks.Immediately apply the Adobe hotfix or upgrade to the latest secure version of Adobe Commerce/Magento Open Source., Audit session storage configurations (prioritize moving away from file-based storage if possible)., Monitor for indicators of compromise (e.g., PHP webshells, unusual phpinfo requests)., Block known malicious IPs associated with exploitation attempts (shared by Sansec)., Enable WAF rules to detect and block SessionReaper exploitation patterns., Conduct a thorough review of customer accounts for signs of unauthorized access., Educate customers on phishing risks, as compromised accounts may be used for further attacks.Immediately apply the Adobe hotfix or upgrade to the latest secure version of Adobe Commerce/Magento Open Source., Audit session storage configurations (prioritize moving away from file-based storage if possible)., Monitor for indicators of compromise (e.g., PHP webshells, unusual phpinfo requests)., Block known malicious IPs associated with exploitation attempts (shared by Sansec)., Enable WAF rules to detect and block SessionReaper exploitation patterns., Conduct a thorough review of customer accounts for signs of unauthorized access., Educate customers on phishing risks, as compromised accounts may be used for further attacks.Immediately apply the Adobe hotfix or upgrade to the latest secure version of Adobe Commerce/Magento Open Source., Audit session storage configurations (prioritize moving away from file-based storage if possible)., Monitor for indicators of compromise (e.g., PHP webshells, unusual phpinfo requests)., Block known malicious IPs associated with exploitation attempts (shared by Sansec)., Enable WAF rules to detect and block SessionReaper exploitation patterns., Conduct a thorough review of customer accounts for signs of unauthorized access., Educate customers on phishing risks, as compromised accounts may be used for further attacks.

Incident : Vulnerability Exploitation ADO0092800102325

Recommendations: Immediately apply Adobe’s security patches for CVE-2025-54236 and CVE-2024-34102., Monitor network traffic for connections to/from the identified malicious IP addresses (34.227.25[.]4, 44.212.43[.]34, 54.205.171[.]35, 155.117.84[.]134, 159.89.12[.]166)., Audit PHP upload directories (e.g., '/customer/address_file/upload') for unauthorized webshells or backdoors., Implement Web Application Firewalls (WAFs) with rules to detect and block exploitation attempts targeting REST APIs., Conduct regular vulnerability scans and penetration testing for e-commerce platforms, prioritizing deserialization and input validation flaws., Educate developers on secure coding practices to mitigate improper input validation and deserialization risks.Immediately apply Adobe’s security patches for CVE-2025-54236 and CVE-2024-34102., Monitor network traffic for connections to/from the identified malicious IP addresses (34.227.25[.]4, 44.212.43[.]34, 54.205.171[.]35, 155.117.84[.]134, 159.89.12[.]166)., Audit PHP upload directories (e.g., '/customer/address_file/upload') for unauthorized webshells or backdoors., Implement Web Application Firewalls (WAFs) with rules to detect and block exploitation attempts targeting REST APIs., Conduct regular vulnerability scans and penetration testing for e-commerce platforms, prioritizing deserialization and input validation flaws., Educate developers on secure coding practices to mitigate improper input validation and deserialization risks.Immediately apply Adobe’s security patches for CVE-2025-54236 and CVE-2024-34102., Monitor network traffic for connections to/from the identified malicious IP addresses (34.227.25[.]4, 44.212.43[.]34, 54.205.171[.]35, 155.117.84[.]134, 159.89.12[.]166)., Audit PHP upload directories (e.g., '/customer/address_file/upload') for unauthorized webshells or backdoors., Implement Web Application Firewalls (WAFs) with rules to detect and block exploitation attempts targeting REST APIs., Conduct regular vulnerability scans and penetration testing for e-commerce platforms, prioritizing deserialization and input validation flaws., Educate developers on secure coding practices to mitigate improper input validation and deserialization risks.Immediately apply Adobe’s security patches for CVE-2025-54236 and CVE-2024-34102., Monitor network traffic for connections to/from the identified malicious IP addresses (34.227.25[.]4, 44.212.43[.]34, 54.205.171[.]35, 155.117.84[.]134, 159.89.12[.]166)., Audit PHP upload directories (e.g., '/customer/address_file/upload') for unauthorized webshells or backdoors., Implement Web Application Firewalls (WAFs) with rules to detect and block exploitation attempts targeting REST APIs., Conduct regular vulnerability scans and penetration testing for e-commerce platforms, prioritizing deserialization and input validation flaws., Educate developers on secure coding practices to mitigate improper input validation and deserialization risks.Immediately apply Adobe’s security patches for CVE-2025-54236 and CVE-2024-34102., Monitor network traffic for connections to/from the identified malicious IP addresses (34.227.25[.]4, 44.212.43[.]34, 54.205.171[.]35, 155.117.84[.]134, 159.89.12[.]166)., Audit PHP upload directories (e.g., '/customer/address_file/upload') for unauthorized webshells or backdoors., Implement Web Application Firewalls (WAFs) with rules to detect and block exploitation attempts targeting REST APIs., Conduct regular vulnerability scans and penetration testing for e-commerce platforms, prioritizing deserialization and input validation flaws., Educate developers on secure coding practices to mitigate improper input validation and deserialization risks.Immediately apply Adobe’s security patches for CVE-2025-54236 and CVE-2024-34102., Monitor network traffic for connections to/from the identified malicious IP addresses (34.227.25[.]4, 44.212.43[.]34, 54.205.171[.]35, 155.117.84[.]134, 159.89.12[.]166)., Audit PHP upload directories (e.g., '/customer/address_file/upload') for unauthorized webshells or backdoors., Implement Web Application Firewalls (WAFs) with rules to detect and block exploitation attempts targeting REST APIs., Conduct regular vulnerability scans and penetration testing for e-commerce platforms, prioritizing deserialization and input validation flaws., Educate developers on secure coding practices to mitigate improper input validation and deserialization risks.

Incident : Vulnerability Exploitation ADO0402304102325

Source: Adobe Security Bulletin (CVE-2025-54236)

Date Accessed: 2025-09-08

Incident : Vulnerability Exploitation ADO0402304102325

Source: Sansec Bulletin on SessionReaper Exploitation

Date Accessed: 2025-10-20 (approx., 6 weeks post-patch)

Incident : Vulnerability Exploitation ADO0402304102325

Source: Searchlight Cyber Technical Analysis

Date Accessed: 2025-10-20 (approx.)

Incident : Vulnerability Exploitation ADO5132051102325

Source: Sansec Research Advisory

Date Accessed: 2025-09-11

Incident : Vulnerability Exploitation ADO5132051102325

Source: Assetnote/Searchlight Cyber Technical Deep-Dive by Tomais Williamson

Date Accessed: 2025-09-11

Incident : Vulnerability Exploitation ADO5132051102325

Source: Adobe Security Bulletin for CVE-2025-54236

Date Accessed: 2025-09-09

Incident : Vulnerability Exploitation ADO0092800102325

Source: Sansec Advisory on CVE-2025-54236 Exploitation

Incident : Vulnerability Exploitation ADO0092800102325

Source: Adobe Security Bulletin for CVE-2025-54236

Incident : Vulnerability Exploitation ADO0092800102325

Source: Searchlight Cyber Technical Analysis of CVE-2025-54236

Incident : Vulnerability Exploitation ADO0402304102325

Investigation Status: Ongoing (Active Exploitation Confirmed; Patch Adoption Monitored)

Incident : Vulnerability Exploitation ADO5132051102325

Investigation Status: Ongoing (active exploitation attempts being monitored)

Incident : Vulnerability Exploitation ADO0092800102325

Investigation Status: Ongoing (Active Exploitation Confirmed)

Incident : Vulnerability Exploitation ADO0402304102325

Stakeholder Advisories: Adobe Commerce Administrators: Urgent Patching Required., E-Commerce Security Teams: Monitor For Indicators Of Compromise (Iocs) Tied To The 5 Attacker Ips., Customers: Watch For Unauthorized Account Activity..

Customer Advisories: Users of Adobe Commerce/Magento stores should:- Change passwords if suspicious activity is detected.- Enable multi-factor authentication (MFA) where available.- Monitor transaction histories for fraud.

Incident : Vulnerability Exploitation ADO5132051102325

Stakeholder Advisories: Urgent Patching Recommended For All Adobe Commerce/Magento Open Source Users.

Customer Advisories: Monitor accounts for unauthorized activityReport suspicious login attempts

Incident : Vulnerability Exploitation ADO0092800102325

Stakeholder Advisories: Adobe Security Bulletin Update, Sansec Public Warning.

Customer Advisories: Urgent Patch Notification for Magento/Adobe Commerce Users

Incident : Vulnerability Exploitation ADO0402304102325

Entry Point: Exploiting Cve-2025-54236 Via Rest Api,

Reconnaissance Period: ['Likely minimal (Opportunistic scans for unpatched systems)']

Backdoors Established: ['PHP Webshells (Observed in Attacks)']

High Value Targets: Customer Session Data, Payment Information (If Accessible),

Data Sold on Dark Web: Customer Session Data, Payment Information (If Accessible),

Incident : Vulnerability Exploitation ADO0092800102325

Entry Point: Commerce Rest Api (Cve-2025-54236), Php File Upload ('/Customer/Address File/Upload'),

Backdoors Established: ['PHP Webshells']

High Value Targets: Customer Account Data, Php Configuration Information,

Data Sold on Dark Web: Customer Account Data, Php Configuration Information,

Incident : Vulnerability Exploitation ADO0402304102325

Root Causes: Improper Input Validation In Adobe Commerce Rest Api (Cve-2025-54236)., Default Insecure Session Storage Configuration (File-System)., Delayed Patch Adoption By Store Administrators.,

Corrective Actions: Adobe: Release Emergency Patch And Public Advisory., Sansec: Deploy Detection Rules And Block Exploitation Attempts., Store Administrators: Apply Patches, Reconfigure Session Storage, And Monitor For Iocs.,

Incident : Vulnerability Exploitation ADO5132051102325

Root Causes: Improper Input Validation In Session Handling (Cve-2025-54236)., Delayed Patching By Majority Of Users (62% Unpatched At Time Of Attacks)., File-Based Session Storage Increasing Severity To Rce In Some Configurations.,

Corrective Actions: Apply Security Patches Promptly Upon Release., Review And Harden Session Storage Mechanisms., Implement Network-Level Protections (E.G., Waf Rules) For Critical Vulnerabilities., Enhance Monitoring For Exploitation Attempts Post-Disclosure.,

Incident : Vulnerability Exploitation ADO0092800102325

Root Causes: Improper Input Validation In Adobe Commerce Rest Api (Cve-2025-54236)., Delayed Patch Application By 62% Of Magento Stores Post-Disclosure., Lack Of Sufficient Monitoring For Deserialization-Based Attacks In E-Commerce Platforms.,

Corrective Actions: Mandatory Patch Enforcement For Critical Vulnerabilities In Adobe Commerce/Magento., Enhanced Api Security Controls (E.G., Input Validation, Rate Limiting)., Automated Vulnerability Management For E-Commerce Platforms With Slas For Patching., Threat Intelligence Sharing To Preempt Exploitation Of Newly Disclosed Flaws.,