Research · Sep 9, 2025
Adobe Commerce and Magento Vulnerability Exposes Users to Session Takeover Risks
Adobe has identified a significant vulnerability in its Commerce and Magento platforms that could allow attackers to take over user sessions without requiring interaction.
What changed
Adobe has reported an Improper Input Validation vulnerability affecting multiple versions of its Commerce and Magento products. This flaw could enable attackers to execute unauthorized actions, leading to potential session takeover.
The impact of this vulnerability is classified as high, as it compromises both the confidentiality and integrity of user data.
Who is affected
Several versions of Adobe Commerce and Magento are impacted by this vulnerability, putting a wide range of users at risk.
Organizations using the following versions should be particularly vigilant:
- Adobe Commerce versions 2.4.9-alpha2
- Adobe Commerce versions 2.4.8-p2
- Adobe Commerce versions 2.4.7-p7
- Adobe Commerce versions 2.4.6-p12
What to do
Users and administrators of affected Adobe Commerce and Magento versions are urged to take immediate action to mitigate risks.
It is recommended to monitor for updates from Adobe and apply patches as soon as they become available.
- Review your current version of Adobe Commerce or Magento.
- Implement security best practices to minimize exposure.
- Stay informed about updates and patches from Adobe.