Vulnerability
Magento vulnerabilities: security advisories, CVEs, exploitation research and how to respond when a new vulnerability drops.
-
Pinned
https://helpx.adobe.com/security/products/magento/apsb26-138.htmlOfficial bulletin for APSB26-138 detailing impacted versions, severity ratings, CVEs, and fixed releases. Only partial content was accessible during fetch; open the link for full details.
-
Pinned
https://helpx.adobe.com/security/products/magento/apsb26-146.htmlAnnounces a hotfix for CVE-2026-75650, a critical template engine vulnerability enabling unauthenticated remote code execution (CVSS 10) and known to be exploited. Lists affected 2.4.x and B2B releases and links to installation instructions.
-
https://slcyber.io/assetnote-security-research-center/why-nested-deserialization-is-still-harmful-magento-rce-cve-2025-54236/
A recent vulnerability in Adobe's e-commerce platform, identified as CVE-2025-54236, poses risks of remote code execution, particularly through file-based session storage, which can be exploited by unauthenticated users. The article analyzes the patch related to this vulnerability, its deserialization mechanisms, and offers insights into potential exploitation methods and vulnerabilities remaining in the application. The narrative provides a deep dive into the exploit chain and necessary payloads while exploring the implications of session management and type handling in the context of security.