CVE-2025-54236

What it actually does

The vulnerability is an unauthenticated, network-exploitable improper input validation flaw that can allow an attacker to take over an existing application session. In the Adobe Commerce/Magento context described by the advisory data, successful exploitation can let the attacker assume another user’s session without user interaction, resulting in high confidentiality and integrity impact: access to private account, order, customer, or administrative data and the ability to perform actions as the compromised session. Availability impact is not the primary consequence. The supplied product mapping also lists traefik-2 on MinimOS with a fixed package version of 2.11.28-r1, so teams should verify the vendor/product mapping in their asset inventory while treating exposed affected commerce services as high risk.

Why it matters to the business

A successful attack can let an external attacker impersonate legitimate users or administrators, which may lead to account compromise, fraudulent transactions, unauthorized order or catalog changes, exposure of customer data, and loss of trust in the affected commerce platform. The CVSS score is critical, EPSS is extremely high, the issue is in the CISA Known Exploited Vulnerabilities catalog, and exploitation is reported as active in the wild under SessionReaper-related activity, so internet-facing systems should be remediated urgently and no later than the CISA KEV deadline of 2025-11-14 where applicable.

How an attack unfolds

An attacker identifies an internet-facing affected commerce instance or vulnerable packaged deployment and sends crafted HTTP requests that abuse insufficient input validation in session-related application handling. Because the flaw requires no authentication and no user interaction, the attacker can attempt exploitation remotely at scale. If successful, the application accepts attacker-controlled input in a way that associates the attacker with a valid victim session or otherwise enables session takeover. The attacker then uses the hijacked session to access customer or administrative functionality, view sensitive data, change account or order information, create or modify administrative users, alter storefront configuration, or stage follow-on activity such as payment-data theft or persistence through legitimate application features. Active exploitation has been associated with SessionReaper reporting and should be investigated as a post-compromise event, not only as a patching issue.

How to fix it

Apply the vendor security update for every affected Adobe Commerce/Magento branch and any downstream package that includes the vulnerable component. The supplied fixed-version data states: traefik-2 on MinimOS is fixed in 2.11.28-r1; upgrade that package to 2.11.28-r1 or later where present, and verify whether this package mapping is applicable to the exposed service. For Adobe Commerce/Magento deployments, upgrade to the fixed release for the exact supported branch rather than relying on configuration-only mitigations. After patching, invalidate active sessions, rotate administrative credentials, review administrative users and API tokens, and clear application caches where vendor guidance requires it. If immediate patching is not possible, restrict external access to administrative and sensitive storefront paths, place the application behind a WAF or reverse proxy rule set tuned for exploit attempts, disable unnecessary modules, enforce MFA for administrator access, and increase logging until remediation is complete.

How to confirm the fix worked

Confirm the running application and package versions from the host package manager, application CLI, vendor admin interface, container image manifest, and software inventory. Validate that traefik-2 on MinimOS, where applicable, is at 2.11.28-r1 or later and that Adobe Commerce/Magento instances are on vendor-fixed builds for their respective branches. Perform an authenticated and unauthenticated vulnerability scan using updated checks for CVE-2025-54236, but do not rely solely on banner versions because commerce applications may be patched without obvious external version disclosure. Verify that all active sessions were invalidated after patching, that no unexpected administrator accounts or API integrations exist, and that web, WAF, and application logs show no continuing exploit attempts succeeding after remediation.

Typical attack path

1. Scan for publicly reachable Adobe Commerce/Magento or mapped affected package deployments at vulnerable versions.
2. Send crafted unauthenticated HTTP requests targeting the vulnerable input-validation path or session-handling behavior.
3. Obtain or bind to a valid application session without the victim interacting with the attacker.
4. Reuse the compromised session cookie or session context to access customer or administrator functions.
5. Enumerate sensitive data such as account details, orders, customer records, configuration, integrations, and payment-related settings.
6. Make unauthorized changes, create persistence through application accounts or configuration, or perform fraudulent business actions.
7. Cover tracks by blending activity with normal authenticated web traffic or using distributed source IPs.

How to detect it

Investigate web server, CDN, WAF, reverse proxy, load balancer, application, authentication, administrator activity, and session-store logs for evidence of session takeover. Look for unauthenticated HTTP requests with unusual encoded or malformed parameters followed closely by authenticated customer or administrator actions from the same source IP, same user agent, or an unexpected geography. Correlate session identifiers across IP addresses and user agents to identify session reuse, especially where a session transitions from a normal user location to a hosting provider, VPN, TOR exit node, or geographically impossible location. Review Adobe Commerce/Magento logs such as var/log/system.log, var/log/exception.log, var/log/debug.log where enabled, web access logs, admin action logs, and WAF events for exploit-like requests and post-exploitation behavior. Search for newly created or modified administrator users, newly added integrations or API tokens, unexpected configuration changes, suspicious checkout/payment configuration changes, and unusual bulk access to customer, order, or account data. Because active exploitation has been reported under SessionReaper-related activity, include threat-intel tags and case notes referencing SessionReaper in SIEM searches, but validate findings against raw HTTP and application activity. Absence of a single known IOC does not rule out exploitation because session takeover can blend into normal authenticated traffic.

• CVE-2025-54236
• SessionReaper
• /var/log/system.log
• /var/log/exception.log
• /var/log/debug.log
• /var/log/nginx/access.log
• /var/log/nginx/error.log
• /var/log/apache2/access.log
• /var/log/apache2/error.log
• /var/log/httpd/access_log
• /var/log/httpd/error_log
• /var/log/traefik/access.log
• /var/log/traefik/traefik.log
• admin_user_save
• admin_user_delete
• integration_save
• oauth_consumer_save
• payment
• checkout
• Set-Cookie: PHPSESSID
• Cookie: PHPSESSID
• frontend=

What your security team should do

• Treat this as an emergency remediation item for any internet-facing affected commerce deployment because it is KEV-listed, has active in-the-wild exploitation, and has very high EPSS likelihood.
• Patch or upgrade affected systems immediately; for the supplied MinimOS package mapping, upgrade traefik-2 to 2.11.28-r1 or later, and separately confirm Adobe Commerce/Magento fixed versions from the vendor advisory for each branch.
• Before and after patching, invalidate all user and administrator sessions and force re-authentication, especially for privileged users.
• Hunt for exploitation going back at least to the publication date, and longer if logs are available, focusing on unauthenticated requests followed by sudden authenticated access from new IPs or user agents.
• Review administrator accounts, API tokens, OAuth/integration credentials, payment settings, checkout configuration, and recently modified application configuration for unauthorized changes.
• Enable or tighten WAF rules for abnormal encoded parameters, session manipulation attempts, suspicious POST requests, and anomalous access to customer or administrator endpoints.
• Prioritize forensic review for systems showing SessionReaper-related indicators, anomalous session reuse, unexpected admin logins, or changes to commerce configuration.
• If compromise is suspected, preserve web logs, WAF logs, application logs, session-store evidence, and filesystem timestamps before rebuilding or restoring from known-good media.