CVE-2025-27189: Adobe Commerce B2b CSRF Vulnerability

CVE-2025-27189 Overview

CVE-2025-27189 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting Adobe Commerce and Adobe Commerce B2B. The flaw impacts versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2, and earlier releases. An attacker can trick an authenticated user into submitting a forged request that disrupts service availability, producing a denial-of-service condition. Exploitation requires user interaction, typically through a malicious link or attacker-controlled website. Adobe published the fix in security advisory APSB25-26.

Critical Impact
Successful exploitation allows an unauthenticated remote attacker to induce a denial-of-service condition against Adobe Commerce storefronts when a logged-in user interacts with a crafted request.

Affected Products

Adobe Commerce B2B versions 1.3.3 through 1.5.1 (including patch releases)
Adobe Commerce 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12 and earlier
Adobe Commerce 2.4.8-beta2 and earlier beta releases

Discovery Timeline

2025-04-08 - CVE-2025-27189 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27189

Vulnerability Analysis

The vulnerability stems from missing or insufficient CSRF token validation on state-changing endpoints within Adobe Commerce. When an authenticated user visits an attacker-controlled page, the browser automatically attaches session cookies to cross-origin requests targeting the Commerce application. The Commerce backend processes these forged requests as legitimate actions performed by the victim. Repeated or resource-intensive forged operations can exhaust application resources, degrade performance, or make the storefront unavailable to legitimate customers.

The attack requires no privileges from the attacker but depends on victim interaction. Because Adobe Commerce powers high-volume e-commerce transactions, availability loss directly translates into revenue impact and customer trust erosion.

Root Cause

The underlying weakness is the absence of anti-CSRF protections on request handlers that perform actions with availability impact. Adobe Commerce relies on form keys and session validation for state-changing operations, and this endpoint did not enforce those checks consistently. This is categorized under [CWE-352] Cross-Site Request Forgery.

Attack Vector

An attacker crafts a malicious HTML page or link that issues a request to a vulnerable Adobe Commerce endpoint. The victim, who is authenticated to the Commerce application, visits the page. The browser sends the forged request with valid session credentials, and the application executes the action. Repeatedly triggering costly operations can exhaust server resources and cause service disruption. See the Adobe Security Advisory APSB25-26 for endpoint-specific details.

Detection Methods for CVE-2025-27189

Indicators of Compromise

Abnormal spikes in requests to Adobe Commerce endpoints originating with Referer headers pointing to external, unrelated domains.
Unusual bursts of authenticated POST requests from a single user session across short time windows.
Web server or application logs showing state-changing requests without valid form keys.

Detection Strategies

Inspect Nginx or Apache access logs for cross-origin Referer values on authenticated Commerce endpoints and correlate with session IDs.
Enable Adobe Commerce logging for form-key validation failures and monitor for elevated failure counts.
Deploy a Web Application Firewall (WAF) rule that flags state-changing requests missing the expected CSRF token or form key.

Monitoring Recommendations

Baseline normal request volumes per endpoint and alert on deviations that suggest resource exhaustion attempts.
Monitor application response times and error rates on customer-facing endpoints for early signs of denial-of-service.
Aggregate web, application, and identity logs into a centralized analytics platform to correlate CSRF indicators across sessions.

How to Mitigate CVE-2025-27189

Immediate Actions Required

Apply the security updates listed in Adobe Security Advisory APSB25-26 to all Adobe Commerce and Commerce B2B installations.
Inventory Commerce instances across production, staging, and development to confirm no vulnerable versions remain reachable.
Review web server and application logs for evidence of prior exploitation attempts against the affected endpoints.

Patch Information

Adobe released patched builds superseding 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, and 2.4.8-beta2. Administrators should upgrade to the latest patched release documented in APSB25-26. Commerce B2B users should update the module to the fixed version corresponding to their Commerce core release.

Workarounds

Enforce strict SameSite=Lax or SameSite=Strict cookie attributes on Commerce session cookies to limit cross-origin credential submission.
Deploy WAF rules that validate the Origin and Referer headers on state-changing Commerce endpoints and drop mismatched requests.
Apply rate limiting on authenticated POST endpoints to reduce the availability impact of forged-request floods.

bash

# Example Nginx configuration enforcing Origin validation and rate limiting
limit_req_zone $binary_remote_addr zone=commerce_post:10m rate=10r/s;

server {
    location ~ ^/(checkout|customer|cart)/ {
        limit_req zone=commerce_post burst=20 nodelay;

        if ($http_origin !~* ^https://(www\.)?example\.com$) {
            return 403;
        }

        proxy_pass http://commerce_backend;
    }
}