{"id":39784,"date":"2025-10-25T07:36:23","date_gmt":"2025-10-25T05:36:23","guid":{"rendered":"http:\/\/159.69.82.204\/win\/?p=39784"},"modified":"2025-10-25T07:36:23","modified_gmt":"2025-10-25T05:36:23","slug":"critical-vulnerability-cve-2025-54236-in-adobe-commerce-magento","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2025\/10\/25\/critical-vulnerability-cve-2025-54236-in-adobe-commerce-magento\/","title":{"rendered":"Critical vulnerability CVE-2025-54236 in Adobe Commerce (Magento)"},"content":{"rendered":"<p><img decoding=\"async\" style=\"float: left; margin: 0px 10px 0px 0px; display: inline;\" title=\"Sicherheit (Pexels, allgemeine Nutzung)\" src=\"https:\/\/www.borncity.com\/blog\/wp-content\/uploads\/2021\/04\/Sicherheit_klein.jpg\" alt=\"Sicherheit (Pexels, allgemeine Nutzung)\" width=\"200\" align=\"left\" \/>[<a href=\"https:\/\/www.borncity.com\/blog\/2025\/10\/24\/kritische-schwachstelle-cve-2025-54236-in-adobe-commerce-magento\/\" target=\"_blank\" rel=\"noopener\">German<\/a>]A critical vulnerability, CVE-2025-54236, has been found in Adobe Commerce software (formerly Magento). Adobe Commerce allows unauthenticated attackers to upload files and, ultimately, even take over accounts. The vulnerability has been assigned a CVSS 3.1 score of 9.1 (on a scale of 1 to 10) and is classified as critical.<\/p>\n<p><!--more--><\/p>\n<p>Magento remains one of the most popular e-commerce solutions on the internet and is estimated to be used on more than 130,000 websites. It is also offered as an enterprise solution by Adobe under the name Adobe Commerce, which is automatically patched. The following <a href=\"https:\/\/x.com\/fofabot\/status\/1981251264446157289\" target=\"_blank\" rel=\"noopener\">tweet<\/a> indicates that the critical vulnerability CVE-2025-54236 also exists in Adobe Commerce.<\/p>\n<p><a href=\"https:\/\/x.com\/fofabot\/status\/1981251264446157289\" target=\"_blank\" rel=\"noopener\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/i.postimg.cc\/tCDfZ8fn\/image.png\" alt=\"Adobe Ecommerce-Schwachstelle\" width=\"542\" height=\"570\" \/><\/a><\/p>\n<p>SearchLight Cyber has published an analysis of the vulnerability in the article <a href=\"https:\/\/slcyber.io\/assetnote-security-research-center\/why-nested-deserialization-is-still-harmful-magento-rce-cve-2025-54236\/\" target=\"_blank\" rel=\"noopener\">Why nested deserialization is STILL harmful \u2013 Magento RCE (CVE-2025-54236)<\/a>. Bleeping Computer has covered the topic in<a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/hackers-exploiting-critical-sessionreaper-flaw-in-adobe-magento\/\" target=\"_blank\" rel=\"noopener\"> this article<\/a>, and The Hacker News has more information <a href=\"https:\/\/thehackernews.com\/2025\/10\/over-250-magento-stores-hit-overnight.html\" target=\"_blank\" rel=\"noopener\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>[German]A critical vulnerability, CVE-2025-54236, has been found in Adobe Commerce software (formerly Magento). Adobe Commerce allows unauthenticated attackers to upload files and, ultimately, even take over accounts. The vulnerability has been assigned a CVSS 3.1 score of 9.1 (on a &hellip; <a href=\"https:\/\/borncity.com\/win\/2025\/10\/25\/critical-vulnerability-cve-2025-54236-in-adobe-commerce-magento\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[63,580,1547],"tags":[64,2965,69,1544],"class_list":["post-39784","post","type-post","status-publish","format-standard","hentry","category-cloud","category-security","category-software","tag-cloud","tag-magento","tag-security","tag-software"],"_links":{"self":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/39784","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/comments?post=39784"}],"version-history":[{"count":1,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/39784\/revisions"}],"predecessor-version":[{"id":39785,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/39784\/revisions\/39785"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/media?parent=39784"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/categories?post=39784"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/tags?post=39784"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}