CVE-2022-24086

critical

Description

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.

References

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24086

https://www.edgescan.com/wp-content/uploads/2024/03/2023-Vulnerability-Statistics-Report.pdf

https://blog.checkpoint.com/research/november-2024s-most-wanted-malware-androxgh0st-leads-the-pack-targeting-iot-devices-and-critical-infrastructure/

https://blog.checkpoint.com/security/october-2024s-most-wanted-malware-infostealers-surge-as-cyber-criminals-leverage-innovative-attack-vectors/

https://blog.checkpoint.com/research/july-2024s-most-wanted-malware-remcos-and-ransomhub-run-rampant/

https://blog.checkpoint.com/security/march-2024s-most-wanted-malware-hackers-discover-new-infection-chain-method-to-deliver-remcos/

https://www.bleepingcomputer.com/news/security/magnet-goblin-hackers-use-1-day-flaws-to-drop-custom-linux-malware/

https://research.checkpoint.com/2024/magnet-goblin-targets-publicly-facing-servers-using-1-day-vulnerabilities/

https://www.tenable.com/cyber-exposure/tenable-2022-threat-landscape-report

https://labs.watchtowr.com/adobe-commerce-magento-rce-cve-2022-24086/

https://www.tenable.com/blog/stylesmuggler-cve-2026-75650-frequently-asked-questions-about-adobe-commerce-and-magento-zero

https://github.com/wubinworks/magento2-session-reaper-patch

https://github.com/wubinworks/magento2-template-filter-patch

https://github.com/iitsmel/Research

https://github.com/TomArni680/CVE-2022-24086-MASS-RCE

https://github.com/oK0mo/CVE-2022-24086-RCE-PoC

https://github.com/TomArni680/CVE-2022-24086-rce

https://github.com/TomArni680/CVE-2022-24086-poc

https://github.com/TomArni680/CVE-2022-24086-RCE

https://github.com/Sam00rx/CVE-2022-24087

https://github.com/shakeman8/CVE-2022-24086-RCE

https://github.com/advisories/GHSA-f8fv-f786-9933

https://helpx.adobe.com/security/products/magento/apsb22-12.html

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-0975

Details

Source: Mitre, NVD

Published: 2022-02-16

Updated: 2026-06-17

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.99199