CISA Known Exploited Vulnerability

This vulnerability is actively exploited in the wild and listed in the CISA Known Exploited Vulnerabilities catalog.

Remediation Deadline: Nov 14, 2025

CVE-2025-54236

High

EPSS 73.7%CISA KEV

Adobe/Commerce and Magento

Description

Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API.

EPSS — Exploit Probability

73.7%

Higher than 98.8% of all CVEs

Required Action

https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-27397 ; https://nvd.nist.gov/vuln/detail/CVE-2025-54236

Risk Assessment

HIGH

In CISA KEV

High EPSS

Details

Severity: High
EPSS: 73.7%
CISA KEV: Yes
Ransomware: Unknown
Articles: 0

Timeline

Published

Oct 24, 2025

Added to KEV

Oct 24, 2025

Remediation Due

Nov 14, 2025

Affected Product

Adobe

Commerce and Magento

View all Adobe CVEs

External Links

NVD (NIST)CVE Details MITRE CVE