SessionReaper (CVE-2025-54236): the unauthenticated Adobe Commerce RCE, explained

What SessionReaper is

CVE-2025-54236 — nicknamed SessionReaper — is an unauthenticated flaw in the Adobe Commerce / Magento Open Source Commerce REST API. Adobe rates it CVSS 9.1 and shipped an out-of-band fix on 9 September 2025 in bulletin APSB25-88. It lets an attacker take over customer sessions and, in some configurations, achieve remote code execution — with no account and no interaction from a victim.

Root cause

The bug lives where the REST API turns request data back into PHP objects. A crafted request combines a malicious session payload with a nested deserialization path, so attacker-controlled data is unserialized into live objects. According to Sansec's analysis, the practical trigger abuses the file-upload handling reachable through an address endpoint — content that looks like session data is written and then deserialized, side-stepping authentication.

Deserialization bugs are dangerous precisely because they don't need a memory-corruption primitive: PHP will happily rebuild whatever object graph the serialized blob describes, and Magento's large dependency surface provides "gadget" chains that turn that into file writes or code execution.

How attackers abuse it

• Send an unauthenticated request to the vulnerable REST endpoint with a serialized payload.
• The payload hijacks or forges a session — enabling account/session takeover.
• On stores with the right configuration, the deserialization chain reaches code execution, after which attackers typically drop a web shell and add a rogue admin user for persistence.

Am I affected?

Adobe Commerce and Magento Open Source 2.4.8-p2 and earlier are affected unless the APSB25-88 hotfix is applied. Because the engine only ever reads your branch remotely, treat any 2.4.x store as "assume vulnerable until you've confirmed the patch level." Check the applied patch on the box:

composer show magento/product-community-edition
# and check that the APSB25-88 (VULN-32437) hotfix is applied:
ls -la app/etc/ ; bin/magento setup:db:status

How to fix it

1. Apply the APSB25-88 hotfix (VULN-32437) for your line, or upgrade to a fixed release (2.4.8-p3 and later include it), then rebuild.
2. If there is any sign of exploitation, assume session and admin compromise: invalidate all sessions, rotate admin credentials and integration tokens, and rotate the encryption key.
3. Hunt for persistence — new admin users, unexpected cron entries, modified cms_block / layout XML, and web shells in pub/ and media/.

bin/magento setup:upgrade && bin/magento cache:flush
bin/magento admin:user:unlock
# then flush the session store so stolen sessions die

If you can't patch immediately, a community shim (see references) blocks the vulnerable path across 2.3/2.4 — but treat it as a bridge to the official fix, not a destination.