Critical severity · published Feb 16, 2022
CVE-2022-24086
Adobe Commerce checkout improper input validation leads to remote code execution
In wildKEV
9.8
CVSS
99.2%
EPSS
Yes
On KEV
Description
Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)99.2% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Feb 15, 2022
Federal remediation dueMar 1, 2022
Ransomware campaign useNot known
Affected products
Which versions
CO
Commerce · Adobe
before 2.3.0; 2.3.3 through 2.3.6; 2.4.0 through 2.4.2; 2.3.7; 2.3.7; 2.4.3; +1 more · source: NVD
MC
Magento Commerce · Adobe
through 2.4.3-p1; through 2.3.7-p2; through None · source: vendor
CA
Commerce and Magento Open Source · Adobe
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-24086
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-24086
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
https://helpx.adobe.com/security/products/magento/apsb22-12.html
More from Commerce
10.0
CVE-2026-75650
Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
9.8
CVE-2024-34102
XXE can expose crypt key and other secrets granting full admin access
9.3
CVE-2026-48356
Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)
9.1
CVE-2026-71362
Adobe Commerce | Incorrect Authorization (CWE-863)
9.1
CVE-2025-54236
Adobe Commerce | Improper Input Validation (CWE-20)