--- title: "Critical Security Update: Adobe Commerce and Magento Open source (APSB25-88)" url: "https://magecomp.com/blog/security-update-adobe-commerce-magento-open-source-apsb25-88/" date: "2025-09-11T09:19:51+00:00" modified: "2025-09-11T09:27:46+00:00" author: name: "Gaurav Jain" url: "https://magecomp.com/" categories: - "Magento Security" word_count: 534 reading_time: "3 min read" summary: "Security is not optional in today's world of ecommerce - it is essential. Every Magento or Adobe Commerce store owner needs to be aware not just of features and performance but of important securit..." description: "Adobe has released security bulletin APSB25-88 addressing a critical Magento vulnerability (CVE-2025-54236). Learn which versions are affected and how to app..." keywords: "Magento Security" language: "en" schema_type: "Article" related_posts: - title: "Critical RCE Vulnerability in Adobe Commerce: Fix Security Patches MDVA-43395 & MDVA-43443" url: "https://magecomp.com/blog/adobe-commerce-security-patches-mdva-43395-mdva-43443/" - title: "How to Install Magento Security Patches – The Ultimate Guide" url: "https://magecomp.com/blog/how-to-install-magento-security-patches/" - title: "What is Magento Security Scan Tool – All You Need to Know" url: "https://magecomp.com/blog/magento-security-scan-tool/" --- # Critical Security Update: Adobe Commerce and Magento Open source (APSB25-88) _Published: September 11, 2025_ _Author: Gaurav Jain_ ![Critical Security Update Adobe Commerce and Magento Open source (APSB25-88)](https://magecomp.com/blog/wp-content/uploads/2025/09/Critical-Security-Update-Adobe-Commerce-and-Magento-Open-source-APSB25-88-1024x512.webp) Security is not optional in today’s world of ecommerce – it is essential. Every Magento or Adobe Commerce store owner needs to be aware not just of features and performance but of important security patches. **On September 9, 2025, Adobe has published a security bulletin (APSB25-88)** alerting all users of Adobe Commerce, Adobe Commerce B2B, and Magento Open Source to a serious threat and the need to act immediately. Here is what you need to know – the risk you are facing, what versions may be affected and how to resolve the issue. ## What is the Vulnerability (CVE-2025-54236)? - A critical vulnerability (CVE-2025-54236) has been discovered. An attacker could exploit it via the Commerce REST API to take over customer accounts. - The nature of the vulnerability: improper input validation (CWE-20), leading to a security feature bypass. **Note:** Adobe says there is no evidence so far that this vulnerability has been exploited in the wild. However, given the severity, waiting is risky. [![Magento Malware Removal](https://magecomp.com/blog/wp-content/uploads/2025/02/Magento-Malware-Removal-CTA-4.webp)](https://magecomp.com/magento-security-patches-installation.html) ## Which Versions are Affected? | **Product** | **Version** | |---|---| | Adobe Commerce | 2.4.9-alpha2 and earlier2.4.8-p2 and earlier2.4.7-p7 and earlier2.4.6-p12 and earlier2.4.5-p14 and earlier2.4.4-p15 and earlier | | Adobe Commerce B2B | 1.5.3-alpha2 and earlier1.5.2-p2 and earlier1.4.2-p7 and earlier1.3.4-p14 and earlier1.3.3-p15 and earlier | | Magento Open Source | 2.4.9-alpha2 and earlier2.4.8-p2 and earlier2.4.7-p7 and earlier2.4.6-p12 and earlier2.4.5-p14 and earlier | ## What should you do? Here are the steps to remediate and protect your systems: **Apply the hotfix immediately** Adobe has released VULN-32437-2-4-X-patch to address CVE-2025-54236. **Update the Custom Attributes Serializable module** If you are using that module and your version is 0.1.0 to 0.3.0, upgrade to version 0.4.0 or higher. Use the composer command: composer require magento/out-of-process-custom-attributes=0.4.0 –with-dependencies **Upgrade to newest patched version** If possible, upgrade beyond the vulnerable releases to the latest version that includes this fix. Even if you install a hotfix, maintaining up-to-date systems is best practice. Adobe rates this update as “priority 2” so you should plan for more regular updates and monitoring. ## Conclusion This is a serious vulnerability that Adobe has flagged as “critical.” Even though there are no known active exploits yet, the severity means that waiting isn’t wise. Any business running Adobe Commerce / Magento needs to act right away: apply the hotfix, update the module if used, verify the patch, and ensure long-term upgrade paths. If you need help applying the patch, **[MageComp](https://magecomp.com/)** is here to assist. [![Hire Magento Programmer](https://magecomp.com/blog/wp-content/uploads/2025/02/Hire-Magento-Programmer-CTA-2.webp)](https://magecomp.com/services/hire-magento-programmer/) ## FAQ 1. **What is APSB25-88?** APSB25-88 is the Adobe security bulletin published on September 9, 2025. It discloses a critical vulnerability with CVE-2025-54236 for Adobe Commerce, Adobe Commerce B2B and Magento Open Source which may let attackers take over customer accounts through the Commerce REST API. 2. **Which versions of Adobe Commerce and Magento are affected?** - Adobe Commerce & Magento Open Source: 2.4.4-p15 and earlier up to 2.4.9-alpha2. - Adobe Commerce B2B: versions 1.5.3-alpha2 and earlier. - Custom Attributes Serializable module: versions 0.1.0-0.3.0. 3. **Can you assist me in installing the patch?** Yes! MageComp offers an installation service for [**Magento Security Patches**](https://magecomp.com/magento-security-patches-installation.html), where experienced technicians implement the patching. They make sure that compatibility is confirmed, back up your data for safety, install the patches, and as a result, you receive a safe shop, without disruption to store operations. --- _View the original post at: [https://magecomp.com/blog/security-update-adobe-commerce-magento-open-source-apsb25-88/](https://magecomp.com/blog/security-update-adobe-commerce-magento-open-source-apsb25-88/)_ _Served as markdown by [Third Audience](https://github.com/third-audience) v3.5.3_ _Generated: 2026-07-24 08:56:09 UTC_