Hackers have begun actively targeting a critical remote code execution flaw in Adobe’s Magento e-commerce platform, putting thousands of online stores at immediate risk just six weeks after Adobe issued an emergency patch.

Known as SessionReaper and tracked as CVE-2025-54236, the vulnerability allows unauthenticated attackers to hijack customer sessions and potentially execute arbitrary code, leading to data breaches and store compromises.

Security firm Sansec reported blocking over 250 exploitation attempts on October 22, 2025, with attacks originating from multiple IP addresses worldwide.​

Adobe Magento RCE Vulnerability Exploited

SessionReaper stems from an improper input validation issue in Adobe Commerce and Magento Open Source versions, including 2.4.9-alpha2 and earlier, affecting the Commerce REST API.

Discovered by independent researcher Blaklis and patched by Adobe on September 9, 2025, the flaw enables attackers to upload malicious files disguised as session data via the /customer/address_file/upload endpoint, bypassing authentication.

This nested deserialization bug can lead to full remote code execution, especially on systems using file-based session storage, though Redis or database-backed setups may also be vulnerable.​

A detailed technical breakdown released by Assetnote researchers on October 21, 2025, included proof-of-concept code demonstrating the exploit, effectively closing the window for undetected patching.

Sansec’s forensics team likened SessionReaper’s severity rating of 9.1 on the CVSS scale to past Magento threats like CosmicSting (CVE-2024-34102) in 2024, TrojanOrder (CVE-2022-24086) in 2022, and the infamous Shoplift vulnerability in 2015, each resulting in thousands of hacked stores shortly after disclosure.

With exploit details now public, experts predict widespread automated attacks within 48 hours, fueled by scanning tools that thrive on such high-impact flaws, Sansec said.

Despite Adobe’s urgent advisory and hotfix availability, adoption remains alarmingly low. Sansec’s monitoring shows only 38% of Magento stores have applied protections six weeks post-patch, leaving 62% or three in five exposed to this critical threat.

Initial reports from September indicated even fewer than one in three stores were secured, highlighting persistent delays in e-commerce security updates that expose sensitive customer data like payment details to theft.

This vulnerability’s broad impact on global online retailers underscores the urgency, as unpatched sites become prime targets for credential stuffing, malware injection, and supply chain disruptions.​

Mitigations

Store owners must act swiftly to mitigate risks. Adobe recommends deploying the official patch from their repository or upgrading to the latest secure release, with detailed instructions in their developer guide.

For immediate defense without patching, activating a web application firewall (WAF) is crucial; Sansec Shield, for instance, has blocked SessionReaper since discovery and offers a free month via coupon code SESSIONREAPER.

Observed exploits trace back to IPs such as 34.227.25.4, 44.212.43.34, 54.205.171.35, 155.117.84.134, and 159.89.12.166, delivering payloads that probe server configurations or install backdoors.

Sansec continues real-time tracking, urging merchants to monitor for similar activity and follow their live attack dashboard for updates.

As exploitation ramps up, the e-commerce sector faces a potential wave of breaches reminiscent of historical Magento incidents.​

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post Hackers Exploiting Adobe Magento RCE Vulnerability Exploited in the Wild – 3 in 5 Stores Vulnerable appeared first on Cyber Security News.

CISA has issued a critical alert regarding a severe vulnerability in Motex LANSCOPE Endpoint Manager, a popular tool for managing IT assets across networks.

Dubbed an improper verification of the source of a communication channel flaw, this issue allows attackers to execute arbitrary code simply by sending specially crafted packets.

The vulnerability, tracked under CVE-2025-61932, has already been exploited in the wild, prompting CISA to add it to its Known Exploited Vulnerabilities (KEV) catalog.

Organizations using the software are urged to act immediately to prevent potential breaches that could lead to data theft, ransomware deployment, or full system compromise.

This warning comes amid a surge in endpoint management exploits, as cybercriminals increasingly target administrative tools to gain deeper network access.

Motex LANSCOPE, developed by Japanese firm Motex, helps IT teams monitor and control devices remotely, making it a prime target for attackers seeking to pivot from individual endpoints to entire infrastructures.

While specific details on the exploitation campaigns remain limited, security researchers note that the flaw’s remote code execution (RCE) capability makes it particularly dangerous, especially in unpatched environments.

At its core, the vulnerability stems from inadequate checks on incoming communication packets, allowing malicious actors to impersonate legitimate sources.

According to the CWE-940 definition, this improper verification can bypass authentication mechanisms, enabling unauthenticated remote access.

Attackers need only craft packets that mimic trusted traffic, potentially leading to the deployment of malware or backdoors without user interaction.

CISA’s alert highlights that while the vulnerability’s use in ransomware campaigns is currently unknown, its RCE nature aligns with tactics seen in recent high-profile attacks, such as those targeting supply chain weaknesses.

Endpoint managers like LANSCOPE are often deployed in enterprise settings, including sectors like finance and healthcare, where downtime or data exposure could have cascading effects.

Early indicators suggest exploitation may involve phishing-laced packets or direct network probes, underscoring the need for robust network segmentation.

Mitigations

To counter the threat, CISA recommends applying vendor-provided patches or mitigations without delay. Motex has reportedly released updates addressing the issue, but organizations should verify compatibility before deployment.

For cloud-integrated instances, adherence to Binding Operational Directive (BOD) 22-01 is essential, emphasizing vulnerability management in federal systems guidance that extends valuably to private entities.

If patches prove unavailable or ineffective, discontinuing use of the product is advised as a last resort. This incident reflects ongoing challenges in endpoint security, where legacy tools often lag behind evolving threats.

As CISA continues to monitor developments, experts call for proactive measures like regular vulnerability scanning and zero-trust architectures.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post CISA Warns of Motex LANSCOPE Endpoint Manager Vulnerability Exploited in Attacks appeared first on Cyber Security News.