CVE-2022-24086
Adobe Commerce checkout improper input validation leads to remote code execution
Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.
Required action
Apply updates per vendor instructions.
CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2022-24086
Description
Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitation Context
as of October 17, 2026- CISA added CVE-2022-24086 to the KEV catalog 1 day before its CVE record was published.
- It is one of 82 Adobe entries in the CISA KEV catalog, and one of 54 added in 2022.
- Its current EPSS score (99.2%) is higher than that of 87% of CISA KEV entries.
Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| Adobe | Adobe Magento Commerce | unspecified to 2.4.3-p1 unspecified to 2.3.7-p2 unspecified to None |
References
1 LinksRecord Details
More from Adobe
XXE can expose crypt key and other secrets granting full admin access
Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution
Adobe ColdFusion Unrestricted File Upload Vulnerability
Adobe Flash Player Integer Underflow Vulnerablity
Related
Tool categories
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.