Adobe Commerce and Magento Improper Input Validation Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 24/10/2025. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| magento/community-edition | = 2.4.5= 2.4.6= 2.4.7= 2.4.8= 2.4.9≥ 2.4.6-p1, ≤ 2.4.6-p12≥ 2.4.7-beta1, ≤ 2.4.7-p7≥ 2.4.8-beta1, ≤ 2.4.8-p2≥ 2.4.9-alpha1, ≤ 2.4.9-alpha2≤ 2.4.5-p14 | |
| magento/project-community-edition | ≤ 2.0.2 | |
| commerce | = 2.4.4= 2.4.5= 2.4.6= 2.4.7= 2.4.8= 2.4.9 | |
| commerce b2b | = 1.3.3= 1.3.4= 1.4.2= 1.5.2= 1.5.3 | |
| magento | = 2.4.5= 2.4.6= 2.4.7= 2.4.8= 2.4.9 |
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact to high. Exploitation of this issue does not require user interaction.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free