Adobe · Commerce and Magento Open Source
CVE-2022-24086
Adobe Commerce checkout improper input validation leads to remote code execution
What it is
Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.
CISA: Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: March 1, 2022
- Added to the CISA list
- February 15, 2022
- Published
- February 16, 2022
- Severity
- Critical 9.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 99.2% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-20
- More details
- NVD · CVE.org · CISA
All references (1)
More exploited flaws from Adobe
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Jul 17, 2024 | Improper Restriction of XML External Entity Reference (XXE) | Commerce and Magento Open Source | Critical 9.8 | >99.9% |
| Oct 27, 2026 | Unrestricted Upload of File with Dangerous Type | Commerce and Magento | Critical 9.3 | 31% |
| Sep 24, 2026 | Commerce and Magento Incorrect Authorization Vulnerability | Commerce and Magento | Critical 9.1 | 90% |
| Sep 8, 2026 | Improper Neutralization of Special Elements Used in a Template Engine | Commerce and Magento | Critical 10.0 | 3.9% |
| Jul 7, 2026 | Path Traversal | ColdFusion | Critical 10.0 | 42% |
| May 20, 2026 | Heap-Based Buffer Overflow | Acrobat and Reader | High 8.8 | 87% |
| Apr 13, 2026 | Use-After-Free | Acrobat | High 7.8 | 33% |
| Apr 13, 2026 | Prototype Pollution | Acrobat and Reader | High 8.6 | 7.2% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.