CVE-2025-49554: Adobe Commerce DOS Vulnerability

CVE-2025-49554 Overview

CVE-2025-49554 is an Improper Input Validation vulnerability [CWE-20] affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. An unauthenticated remote attacker can submit specially crafted input that causes the application to crash or become unresponsive, resulting in a denial-of-service condition. Exploitation requires no privileges and no user interaction, making the issue trivially reachable over the network on any exposed storefront.

Affected releases include Adobe Commerce 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14, and all earlier versions. Adobe published advisory APSB25-71 to coordinate remediation.

Critical Impact

An unauthenticated attacker can take Adobe Commerce storefronts offline by sending crafted requests over the network, disrupting revenue-generating transactions.

Affected Products

• Adobe Commerce 2.4.4-p14, 2.4.5-p13, 2.4.6-p11, 2.4.7-p6, 2.4.8-p1, 2.4.9-alpha1, and earlier
• Adobe Commerce B2B 1.3.3 through 1.5.3-alpha1
• Magento Open Source 2.4.5 through 2.4.9-alpha1

Discovery Timeline

• 2025-08-12 - CVE-2025-49554 published to NVD
• 2025-08-15 - Last updated in NVD database

Technical Details for CVE-2025-49554

Vulnerability Analysis

The flaw is classified as Improper Input Validation [CWE-20]. Adobe Commerce accepts attacker-controlled input on a network-facing interface without enforcing sufficient validation on its structure or content. When malformed input reaches the affected handler, the application enters an error state that crashes the process or exhausts a resource, leaving the storefront unable to service legitimate requests.

The impact is limited to availability. Confidentiality and integrity are not affected, and exploitation does not yield code execution or data disclosure. However, because Adobe Commerce is typically the primary commerce front end for retailers, downtime directly translates to lost transactions and customer trust erosion.

Root Cause

The root cause is missing or insufficient validation logic on input parsed by the application. Adobe has not disclosed the specific endpoint or parameter to limit pre-patch exploitation, and consolidated remediation is provided through the APSB25-71 bulletin rather than per-component patches.

Attack Vector

The attack vector is network-based with low complexity and no authentication. An attacker sends a single crafted HTTP request to the targeted Adobe Commerce instance. Repeated requests, or a malformed payload that triggers an unhandled exception, render the application unresponsive until it is restarted. The vulnerability can be abused from any internet host that can reach the storefront.

No public proof-of-concept exploit has been observed, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-49554

Indicators of Compromise

• Unexplained PHP-FPM or web worker crashes correlated with specific inbound request patterns to Adobe Commerce endpoints.
• Spikes in HTTP 5xx responses from the storefront without corresponding traffic volume increases.
• Repeated requests from a single source IP carrying unusually malformed parameters, headers, or JSON bodies.

Detection Strategies

• Monitor application logs in var/log/ for recurring exception traces or fatal errors aligned with external requests.
• Inspect web application firewall (WAF) telemetry for malformed input patterns targeting Adobe Commerce REST, GraphQL, or admin endpoints.
• Baseline storefront request latency and error rates, then alert on deviations consistent with resource exhaustion.

Monitoring Recommendations

• Forward Adobe Commerce, NGINX or Apache, and PHP-FPM logs to a centralized SIEM for correlation across the request lifecycle.
• Track process restart frequency for Magento worker processes as a leading availability indicator.
• Enable rate-based alerting on high-error sources to detect denial-of-service attempts in progress.

How to Mitigate CVE-2025-49554

Immediate Actions Required

• Apply the Adobe security update referenced in Adobe Security Advisory APSB25-71 to all Commerce, Commerce B2B, and Magento Open Source instances.
• Inventory all Adobe Commerce deployments, including staging and development, and confirm version against the affected list.
• Place a WAF in front of public storefronts to filter malformed requests until patching is complete.

Patch Information

Adobe addressed CVE-2025-49554 in the August 2025 security release. Administrators should upgrade Adobe Commerce and Magento Open Source to the fixed versions listed in APSB25-71, and Adobe Commerce B2B to the corresponding B2B release. Review the advisory for exact patched version numbers and apply the update through the standard Composer-based upgrade workflow.

Workarounds

• Enforce strict input validation and request size limits at the upstream WAF or reverse proxy.
• Apply rate limiting on REST, GraphQL, and admin endpoints to reduce the impact of DoS attempts.
• Configure process supervisors to auto-restart crashed PHP-FPM workers, maintaining availability during ongoing attacks.

# Example NGINX rate limit and request size hardening for Adobe Commerce
http {
    limit_req_zone $binary_remote_addr zone=commerce:10m rate=20r/s;
    client_max_body_size 8m;

    server {
        location ~ ^/(rest|graphql|admin) {
            limit_req zone=commerce burst=40 nodelay;
            limit_req_status 429;
            proxy_pass http://magento_backend;
        }
    }
}