{"id":"CVE-2022-24086","kind":"vulnerability","aliases":["CVE-2022-24086"],"related":[],"title":"Adobe Commerce and Magento Open Source: Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability","description":"Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.","summary":"Adobe Commerce and Magento Open Source contain an improper input validation flaw that lets an attacker run arbitrary code on the store server. CISA lists it as actively exploited in the wild.","severity":"critical","cvss":10.0,"epss":0.99199,"exploited":true,"exploited_at":"2022-02-15T00:00:00+00:00","products":[{"name":"Adobe Commerce and Magento Open Source","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["adobe-commerce","exploited","magento","php","runtime","self-hosted"],"not_affected_if":["managed-hosting","unknown"],"how_to_check":null,"fix":"Apply the updates per Adobe's vendor instructions; the sources do not name the fixed version.","status":"open","published_at":"2022-02-15T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:26:32+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-23T21:26:32Z","model":"claude-haiku-5-5","output":{"fix":"Apply the updates per Adobe's vendor instructions; the sources do not name the fixed version.","reach":"unknown","impact":"high","summary":"Adobe Commerce and Magento Open Source contain an improper input validation flaw that lets an attacker run arbitrary code on the store server. CISA lists it as actively exploited in the wild.","category":"runtime","who_cares":["magento","adobe-commerce","php","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the store server","analyst_note":"Find the affected and fixed Adobe Commerce/Magento versions and the advisory (APSB22-12) in Adobe's security bulletin, and the auth and exposure requirements.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting","unknown"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000458,"input_tokens":2845,"output_tokens":346,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2022':18A,21A '-24086':19A,22A '2.3.7':79C '2.4.3':74C 'activ':66B 'adob':1A,7A,30B,39B,71C 'adobe':23A 'adobe-commerc':29B 'affect':84C 'and':25A 'arbitrari':56B,108C 'attack':54B 'checkout':93C 'cisa':62B 'code':57B,109C 'commerc':2A,8A,31B,40B,72C 'commerce':24A 'contain':45B 'could':105C 'cve':17A,20A 'earlier':77C,82C 'execut':110C 'exploit':32B,67B,95C 'flaw':50B 'host':38B 'improp':13A,47B,87C 'input':14A,48B,88C 'interact':103C 'issu':98C 'let':52B 'list':63B 'magento':4A,10A,26A,33B,42B 'open':5A,11A,27A,43B 'p1':75C 'p2':80C 'php':34B 'process':94C 'requir':101C 'result':106C 'run':55B 'runtim':35B 'self':37B 'self-host':36B 'server':61B 'sourc':6A,12A,44B 'source':28A 'store':60B 'user':102C 'valid':15A,49B,89C 'version':73C 'vulner':16A,90C 'wild':70B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-02-15T00:00:00+00:00","kev":{"dateAdded":"2022-02-15","dueDate":"2022-03-01","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-24086","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-24086","severity":null,"published_at":"2022-02-15T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T11:39:17+00:00","note":null},{"source":"epss","external_id":"CVE-2022-24086","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-24086","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-24086","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24086","severity":null,"published_at":"2022-02-16T17:15:13+00:00","modified_at":"2026-06-17T04:31:16+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}