What’s Vulnerable › Vulnerabilities

CVE-2022-24086: Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability

• Severity: critical (CVSS 10.0 v2.0)
• Exploited in the wild: yes — in CISA KEV since 2022-02-15
• EPSS: 99.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-02-16 · updated 2026-06-17
• Weakness: CWE-20

Description

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.

Affected products

• Adobe Commerce: before 2.3.0; from 2.3.3 through 2.3.6; from 2.4.0 through 2.4.2; 2.3.7-p1, 2.3.7-p2, 2.4.3, 2.4.3-p1 — fixed in 2.3.0
• Adobe Magento: before 2.3.0; from 2.3.3 (excl.) through 2.3.6; from 2.4.0 through 2.4.2; 2.3.7-p1, 2.3.7-p2, 2.4.3, 2.4.3-p1 — fixed in 2.3.0

How to fix

Upgrade to a fixed version: Adobe Commerce 2.3.0; Adobe Magento 2.3.0. Check the vendor advisory for mitigations.

References

• https://helpx.adobe.com/security/products/magento/apsb22-12.html
• https://helpx.adobe.com/security/products/magento/apsb22-12.html
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24086

Get alerted when CVE-2022-24086 or the next vulnerability affects your stack