CVEvulnerability

CVE-2022-24086

9.8 CRITICAL Known exploited Published 2022-02-16 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability — Adobe Commerce and Magento Open Source

Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution.

Added to KEV: 2022-02-15
Remediation due: 2022-03-01
Ransomware use: Unknown
Required action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2022-24086

Status: Analyzed
Published: 2022-02-16
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected]): 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses: CWE-20

Description

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.

Affected configurations

• adobe commerce (< 2.3.0) • adobe commerce (>= 2.3.3 <= 2.3.6) • adobe commerce (>= 2.4.0 <= 2.4.2) • adobe commerce 2.3.7 • adobe commerce 2.4.3 • adobe magento (< 2.3.0) • adobe magento (> 2.3.3 <= 2.3.6) • adobe magento (>= 2.4.0 <= 2.4.2) • adobe magento 2.3.7 • adobe magento 2.4.3

Weakness · CWE (1)

CWE-20 Improper Input Validation weakness

References