SessionReaper attacks have started, 3 in 5 stores still vulnerable
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-54236 | Unauthenticated Session Takeover in Adobe Commerce and Magento (SessionReaper) | 9.1 | 96% | KEVPoC ×2 | KEV |
| CVE-2026-75650 | Unauthenticated Template Injection RCE in Adobe Commerce and Magento (CVE-2026-75650) | 10.0 | 99% | KEVPoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 155.117.84.134 | m the following IPs. 34.227.25.4 44.212.43.34 54.205.171.35 155.117.84.134 159.89.12.166 Attack payloads so far contained PHP webshell |
| ipv4 | 159.89.12.166 | IPs. 34.227.25.4 44.212.43.34 54.205.171.35 155.117.84.134 159.89.12.166 Attack payloads so far contained PHP webshells or phpinfo p |
| ipv4 | 34.227.25.4 | ce attacks here. Attacks are coming from the following IPs. 34.227.25.4 44.212.43.34 54.205.171.35 155.117.84.134 159.89.12.166 Att |
| ipv4 | 44.212.43.34 | ere. Attacks are coming from the following IPs. 34.227.25.4 44.212.43.34 54.205.171.35 155.117.84.134 159.89.12.166 Attack payloads |
| ipv4 | 54.205.171.35 | are coming from the following IPs. 34.227.25.4 44.212.43.34 54.205.171.35 155.117.84.134 159.89.12.166 Attack payloads so far contain |
From the original article
2 min read at sansec.io
Six weeks after Adobe's emergency patch for SessionReaper (CVE-2025-54236) , the vulnerability has entered active exploitation. Sansec Shield detected and blocked the first real-world attacks today, which is bad news for the thousands of stores that remain unpatched.
By Sansec Forensics Team · sansec.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.