Magento SessionReaper (CVE-2025-54236): is my store affected and how do I patch it?

What it is

• Adobe’s bulletin APSB25-88 (9 September 2025) describes a critical improper input validation flaw (CWE-20) that leads to a security feature bypass, CVSS 3.1 score 9.1, no authentication and no admin rights needed.
• Adobe’s support article says an attacker could take over customer accounts through the Commerce REST API.
• Sansec, which named the bug SessionReaper, reports that in some configurations it can lead to unauthenticated remote code execution. That is Sansec’s finding, not part of Adobe’s bulletin.
• On 22 October 2025 Adobe added that it is aware of the CVE being exploited in the wild, and on 24 October 2025 it raised the priority to 1.

Affected versions

How to fix

• Apply Adobe’s isolated hotfix VULN-32437-2-4-X-patch (downloadable from repo.magento.com) using Adobe’s instructions for applying a composer patch, or upgrade to a later Adobe security release for your line.
• If magento/out-of-process-custom-attributes is installed, update it as Adobe instructs (composer require magento/out-of-process-custom-attributes=0.4.0 --with-dependencies), then apply the hotfix.
• Adobe Commerce on cloud infrastructure received WAF rules from Adobe, but Adobe still requires the hotfix.
• Because Adobe reports in-the-wild exploitation, review customer accounts and the server for signs of compromise after patching.

How to check your store

Read-only commands. Compare the version with the table above; on Adobe Commerce cloud, confirm the patch shows as Applied.

# Which Magento / Adobe Commerce version is installed? (read-only)
bin/magento --version
composer show magento/product-community-edition magento/product-enterprise-edition 2>/dev/null | grep -E '^(name|versions)'

# Is the Custom Attributes Serializable module installed, and which version?
composer show magento/out-of-process-custom-attributes 2>/dev/null | grep versions

# Adobe Commerce on cloud / with Quality Patches Tool: patch status
vendor/bin/magento-patches -n status | grep -E '32437|Status'

And the PHP underneath

Magento stores also run on PHP, which has its own October 2026 PHP2Shell bugs. Check the PHP version separately on the Magento product page and the PHP version pages.