Every CVE Search/ Get API key

CVE-2022-24086

Adobe Commerce checkout improper input validation leads to remote code execution

9.8 CriticalIn KEVPublic exploitFix available

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

99.2%Up 98.1 points since Feb 17, 2022
90%50%10%1%

What each source reports

CVE List Score used 9.8

Adobe Commerce checkout improper input validation leads to remote code execution

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.

Record
CVE-2022-24086
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-20
Updated
2026-11-02
EUVDEUVD-2022-0975 9.8

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.

Record
EUVD-2022-0975
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-f8fv-f786-9933 9.8

Magento improper input validation vulnerability

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.

Record
GHSA-f8fv-f786-9933
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Weakness
CWE-20
Updated
2026-11-02
CISA KEV No score

Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability

Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution.

Record
CVE-2022-24086
Weakness
CWE-20
Updated
2026-11-02
NVD 9.8

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.

Record
CVE-2022-24086
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-20
Updated
2026-11-02
OSV 9.8

Adobe Commerce checkout improper input validation leads to remote code execution

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.

Record
CVE-2022-24086
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-20
Updated
2026-11-02
OSVGHSA-f8fv-f786-9933 9.8

Magento improper input validation vulnerability

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.

Record
GHSA-f8fv-f786-9933
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Weakness
CWE-20
Updated
2026-11-02
OSVBIT-magento-2022-24086 No score

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.

Record
BIT-magento-2022-24086
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
magento/community-edition
Packagist
 2.3.3-p1 up to 2.3.7-p3
2.3.7-p3
magento/community-edition
Packagist
 2.4.0 up to 2.4.3-p2
2.4.3-p2
magento
Bitnami
 before 2.3.0, 2.3.3 to 2.3.6, 2.3.7-p1 to 2.3.7-p1, 2.3.7-p2 to 2.3.7-p2, 2.4.0 to 2.4.2, 2.4.3-p1 to 2.4.3-p1, 2.4.3 to 2.4.3
2.3.0
magento/community-edition
Packagist
 2.3.3-p1 up to 2.3.7-p3, plus listed versions
2.3.42.3.4-p22.3.52.3.5-p12.3.5-p2
Show 5 moreShow less
2.3.62.3.6-p12.3.72.3.7-p12.3.7-p2
2.3.7-p3
magento/community-edition
Packagist
 2.4.0 up to 2.4.3-p2, plus listed versions
2.4.0-p12.4.12.4.1-p12.4.22.4.2-p12.4.2-p22.4.32.4.3-p1
2.4.3-p2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubMr-xn/CVE-2022-240862022-02-20
PoC in GitHubnanaao/CVE-2022-24086-RCE2022-02-28
PoC in GitHubNHPT/CVE-2022-24086-RCE2022-03-15
PoC in GitHuboK0mo/CVE-2022-24086-RCE-PoC2022-05-19
PoC in GitHubseymanurmutlu/CVE-2022-24086-CVE-2022-240872022-06-12
PoC in GitHubakr3ch/CVE-2022-240862022-10-01
PoC in GitHubpescepilota/CVE-2022-240862022-12-20
PoC in GitHubBurpRoot/CVE-2022-240862023-09-03
PoC in GitHubwubinworks/magento2-template-filter-patch2024-11-25
NucleiAdobe Commerce (Magento) - Remote Code Execution

History

History
RecordedChangedSources
exploitation, exploits
first indexedCVE List, EUVD, GitHub Advisories, CISA KEV, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-24086 is a critical vulnerability (CVSS 9.8) in Adobe Commerce, published February 16, 2022. CISA lists it as known to be exploited, since February 15, 2022. EUVD reports exploitation since February 15, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 99.2%, the 99th percentile. Fixed in magento/community-edition 2.3.7-p3.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open