SESSIONREAPER, UNAUTHENTICATED RCE IN MAGENTO & ADOBE COMMERCE

Summary from the TLDR InfoSec newsletter

Adobe released an emergency patch for a critical (CVSS 9.1) vulnerability in all versions of Adobe Commerce and Magento. The vulnerability allows for customer account takeover as well as unauthenticated remote code execution in some circumstances. The attack combines a malicious session with a nested deserialization bug.