E-commerce security company Sansec has warned that threat actors have begun to exploit a recently disclosed security vulnerability in Adobe Commerce and Magento Open Source platforms, with more than 250 attack attempts recorded against multiple stores over the past 24 hours.
The vulnerability in question is CVE-2025-54236 (CVSS score: 9.1), a critical improper input validation flaw that could be abused to take over customer accounts in Adobe Commerce through the Commerce REST API.
Also known as SessionReaper, it was addressed by Adobe last month. A security researcher who goes by the name Blaklis is credited with the discovery and responsible disclosure of CVE-2025-54236.
The Dutch company said that 62% of Magento stores remain vulnerable to the security flaw six weeks after public disclosure, urging website administrators to apply the patches as soon as possible before broader exploitation activity picks up. Adobe has since revised its advisory to confirm reports of in-the-wild exploitation of CVE-2025-54236.
The attacks have originated from the following IP addresses, with unknown threat actors leveraging the flaw to drop PHP webshells or probe phpinfo to extract PHP configuration information.
- 34.227.25[.]4
- 44.212.43[.]34
- 54.205.171[.]35
- 155.117.84[.]134
- 159.89.12[.]166
“PHP backdoors are uploaded via ‘/customer/address_file/upload’ as a fake session,” Sansec said.
The development comes as Searchlight Cyber published a detailed technical analysis of CVE-2025-54236, describing it as a nested deserialization flaw that enables remote code execution.
It’s worth noting that CVE-2025-54236 is the second deserialization vulnerability impacting Adobe Commerce and Magento platforms in as many years. In July 2024, another critical flaw dubbed CosmicSting (CVE-2024-34102, CVSS score: 9.8) was subjected to widespread exploitation.
With proof-of-concept (PoC) exploits and additional specifics now entering public domains, it’s imperative that users move quickly to apply the fixes.
Update
In an update shared on October 26, 2025, Sansec said “mass attacks have hit 49% of all stores” and that it estimates “16-18% of all Magento stores now have one or more backdoors injected.”
Akamai, which also observed activity in the wild of CVE-2025-54236, said it detected more than 300 exploitation attempts against over 130 different hosts over a 48-hour time period starting on October 22, 2025, with the attacks originating from 11 unique IP addresses.
Some of the payloads deployed following the exploitation include PHP web shells that can be used to gain persistent access to the web server, and reconnaissance probes using phpinfo() and echo.
(The story was updated after publication on October 30, 2025, with additional insights from Sansec and Akamai.)
