Vulnerability Intelligence Report
Adobe Commerce | Improper Input Validation (CWE-20)
CVE-2025-54236
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.
CISA KEV
Nuclei Template
SSVC: Active Exploitation
Automatable
CVSS Base Score
9.1
CRITICAL
Exploitability:3.9
Impact Score:5.2
Temporal Score:9.1
EPSS Probability:96.74%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-20 ↗Improper Input Validation (CWE-20)
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Adobe | Adobe Commerce | 0 <= 2.4.4-p15 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
CISA KEV
ACTIVE IN CATALOG
Nuclei Template
SCANNER AVAILABLE
EPSS Score
96.742%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Adobe Systems Incorporated · Vendor · USA |
| Reserved | 2025-07-17T21:15:02 |
| Published | 2025-09-09T13:20:17 |
| Patch Date | 2025-09-09 |
| Last Updated | 2025-10-24T22:20:23 |
Community Chatter & Buzz