Exploited Vulnerabilities DailyCVE-2025-54236: Adobe Commerce and Magento
EPSS94.5%No. 380 of 1739 in KEV
CVE year2025listed the same year
Same vendor in KEV82
Same product1
| Field | Value |
|---|---|
| Vendor | Adobe |
| Product | Commerce and Magento |
| Name | Adobe Commerce and Magento Improper Input Validation Vulnerability |
| Added to KEV | 2025-10-24 |
| US federal due date | 2025-11-14 |
| Ransomware use | Unknown |
| CWE | CWE-20 |
CISA description
Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API.
Data from CISA's Known Exploited Vulnerabilities (KEV) catalog. EPSS is FIRST's estimated probability of exploitation activity in the next 30 days, refreshed weekly. Always follow the vendor's official guidance.
About this page
A Adobe Commerce and Magento vulnerability added to CISA's Known Exploited Vulnerabilities catalog on 2025-10-24.