SessionReaper: Critical Magento Flaw Actively Exploited by Hackers
Hackers have begun actively exploiting a critical vulnerability in Adobe Commerce and Magento Open Source platforms, despite the issue having been officially patched last month. Over the past 24 hours, more than 250 attack attempts have been recorded against online stores using these systems, signaling the onset of a large-scale exploitation campaign. The most dangerous attacks involve API-based creation of fraudulent user sessions, allowing adversaries to fully compromise customer accounts.
The flaw, tracked as CVE-2025-54236, carries a CVSS severity score of 9.1. It stems from improper input validation in the Commerce REST API interface, which enables remote code execution by attackers. Researchers have dubbed the vulnerability SessionReaper. It was discovered and disclosed by a security researcher operating under the pseudonym Blaklis, after which Adobe issued a corresponding patch. Nevertheless, six weeks after disclosure, over 60% of Magento installations remain unpatched, leaving them highly susceptible to compromise.
According to a report by Sansec, the malicious campaign is linked to a cluster of IP addresses from which attackers upload PHP web shells via the endpoint “/customer/address_file/upload”, disguising their activity as legitimate client sessions. In some cases, requests to phpinfo were observed, likely used to gather environment configuration details. The objective is to establish persistent system access and expand the attack vector through arbitrary code execution.
Meanwhile, researchers at Searchlight Cyber published a technical analysis of CVE-2025-54236, describing it as a complex nested deserialization flaw that allows remote command execution on the target server. This marks the second major deserialization vulnerability affecting Adobe Commerce and Magento in the past two years. In the summer of 2024, a similar flaw known as CosmicSting (CVE-2024-34102)—rated 9.8 on the CVSS scale—was widely exploited.
As exploit code and technical details continue to circulate in public repositories, experts urgently warn administrators to update their systems immediately. Any delay in applying patches, they caution, creates a fertile environment for mass compromises amid the already escalating wave of active attacks.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
