Introduction
Session hijacking and privilege escalation attacks on e-commerce platforms can directly affect business operations, customer trust, and regulatory compliance. Adobe Commerce (formerly Magento) is widely used by online retailers, so a vulnerability in it has unusually wide reach.
Adobe Commerce and Magento Open Source run thousands of online stores worldwide. They are flexible and extensible, which has made them a popular choice for businesses of every size, from small retailers to large enterprises. Adobe runs a proactive security program and regularly publishes advisories and patches for newly discovered vulnerabilities.
Technical Information
CVE-2025-54264 is a stored cross-site scripting vulnerability (CWE-79) in Adobe Commerce and Magento Open Source. An attacker with high-privileged access can inject malicious JavaScript into certain form fields in the administrative interface. The application stores that code in its database, and it runs in the browser of any user who later opens the affected page. The attack works over the network and needs no complex preconditions, but the attacker must have high privileges and a victim must interact with the compromised page.
The root cause is insufficient input validation and output encoding on specific form fields, so user-supplied data is rendered as executable JavaScript. The vulnerability is classified as having a changed scope, which means exploitation can affect components beyond the vulnerable one. The main risk is session hijacking. An attacker who steals session cookies or tokens can impersonate users, and from there can escalate privileges further or compromise data. No public proof of concept or vulnerable code snippets are available at this time.
Patch Information
Adobe has released security updates for Adobe Commerce and Magento Open Source that fix several vulnerabilities, including CVE-2025-54264. Adobe recommends updating your installation to the latest versions:
-
Adobe Commerce:
- 2.4.9-alpha3 for 2.4.9-alpha2
- 2.4.8-p3 for 2.4.8-p2 and earlier
- 2.4.7-p8 for 2.4.7-p7 and earlier
- 2.4.6-p13 for 2.4.6-p12 and earlier
- 2.4.5-p15 for 2.4.5-p14 and earlier
- 2.4.4-p16 for 2.4.4-p15 and earlier
-
Adobe Commerce B2B:
- 1.5.3-alpha3 for 1.5.3-alpha2
- 1.5.2-p3 for 1.5.2-p2 and earlier
- 1.4.2-p8 for 1.4.2-p7 and earlier
- 1.3.4-p13 for 1.3.4-p12 and earlier
- 1.3.3-p14 for 1.3.3-p13 and earlier
- 1.3.3-p16 for 1.3.3-p15 and earlier
-
Magento Open Source:
- 2.4.9-alpha3 for 2.4.9-alpha2
- 2.4.8-p3 for 2.4.8-p2 and earlier
- 2.4.7-p8 for 2.4.7-p7 and earlier
- 2.4.6-p13 for 2.4.6-p12 and earlier
- 2.4.5-p15 for 2.4.5-p14 and earlier
Adobe gives these updates a priority rating of 2, meaning they fix vulnerabilities that could be exploited, though Adobe is not aware of any exploits in the wild for these issues. Apply the updates promptly to protect your Adobe Commerce or Magento Open Source installation.
Installation instructions and release notes are in the 2.4.x release notes.
Affected Systems and Versions
CVE-2025-54264 affects the following products and versions:
- Adobe Commerce: 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and all earlier versions
- Adobe Commerce B2B: 1.5.3-alpha2, 1.5.2-p2, 1.4.2-p7, 1.3.4-p12, 1.3.3-p13, 1.3.3-p15 and all earlier versions
- Magento Open Source: 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14 and all earlier versions
Any installation running these versions without the latest patches is vulnerable. That applies to default and customized deployments alike, as long as they include the vulnerable code paths.
Vendor Security History
Adobe Commerce (Magento) has had earlier vulnerabilities, including cross-site scripting, remote code execution, and privilege escalation. Adobe typically responds quickly to new reports and issues advisories and patches within weeks. The company runs a public bug bounty program and coordinates with security researchers on responsible disclosure. Its security bulletins are detailed and include clear patch instructions, the mark of a mature vulnerability management process.
