SessionReaper (CVE-2025-54236): critical vulnerability in Magento 2
SessionReaper is a critical vulnerability in the REST API of Magento 2 and Adobe Commerce. What it allows, which patch fixes it and what to check if you patched late.
On 9 September 2025, Adobe released an emergency patch for Magento 2 and Adobe Commerce with bulletin APSB25-88. It fixes CVE-2025-54236, which Sansec named SessionReaper. All supported versions are affected. It is rated 9.1 (CVSS 3.1).
What is SessionReaper?
The cause is missing input validation in the REST API. An attacker without an account can take over customer accounts. If the shop stores sessions as files on the server (the default), code execution may also be possible. Shops with sessions in Redis or the database are less exposed but should patch anyway.
What you should do
- Apply the patch from APSB25-88 or upgrade to a release that includes it (from October 2025 in the regular update APSB25-94).
- Test custom modules and extensions after patching: the patch restricts internal functionality, which occasionally breaks third-party code.
- If you patched late: run a malware scan, and if anything turns up, rotate the encryption key, reset admin passwords and delete unknown integrations.
Update October 2025
From 22 October 2025 Sansec observed mass attacks. Adobe then confirmed exploitation and raised the patch to its highest priority. According to Sansec, only just over a third of shops were patched at that point.
I apply the patch to the shops I look after and can also help other shops at short notice. Write to me or email contact@maxanoo.com.
Sources: Adobe APSB25-88 · Sansec: SessionReaper. As of September 2025, updated October 2025.