Adobe Commerce and Magento Improper Input Validation Vulnerability

Public source report. This item is not matched to your stack and does not establish whether you are affected.

• NewsExploited · CISA KEVAdobe · Commerce and Magento

  Adobe Commerce and Magento Improper Input Validation Vulnerability

  CVE-2025-54236

  Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API.

  CISA's required action · due 14 Nov 2025 for U.S. federal civilian agencies

  Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  Cited by CISA: experienceleague.adobe.com · nvd.nist.gov

  Added to KEV 24 Oct 2025 · Source checked 23 Oct 2026, 23:15 UTC · CISA KEV entry

  Loading voting…