CVE-2025-54236
KEVAdobe Commerce and Magento Improper Input Validation Vulnerability
View CVE record →- Vendor / Project
- Adobe
- Product
- Commerce and Magento
- Date added
- Oct 24, 2025
- Due date
- Nov 14, 2025
- Known ransomware use
- Unknown
- CWEs
- CWE-20
Description
Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.