PT-2025-32863 · Adobe · Commerce

Published 2025-08-12 · Updated 2025-08-15 · CVE-2025-49554

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.9-alpha1 through 2.4.4-p14 and earlier

Description: Adobe Commerce is affected by an improper input validation issue that could lead to a denial-of-service (DoS). An attacker could exploit this issue by providing specially crafted input, causing the application to crash or become unresponsive. Exploitation of this issue does not require user interaction.

Recommendations: Adobe Commerce versions prior to 2.4.9-alpha1 should be updated. Adobe Commerce version 2.4.8-p1 should be updated. Adobe Commerce version 2.4.7-p6 should be updated. Adobe Commerce version 2.4.6-p11 should be updated. Adobe Commerce version 2.4.5-p13 should be updated. Adobe Commerce version 2.4.4-p14 should be updated.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2025-10816

CVE-2025-49554

GHSA-XGFM-992V-H2HR

Affected Products

Commerce

References · 9

• https://osv.dev/vulnerability/GHSA-xgfm-992v-h2hr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49554 · Security Note
• https://bdu.fstec.ru/vul/2025-10816 · Security Note
• https://helpx.adobe.com/security/products/magento/apsb25-71.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-49554 · Vendor Advisory
• https://github.com/magento/magento2 · Note
• https://twitter.com/CVEnew/status/1955658281097019495 · Twitter Post
• https://t.me/cveNotify/132459 · Telegram Post
• https://twitter.com/CCBalert/status/1955626740144800103 · Twitter Post