---
id: "CVE-2022-24086"
kind: "vulnerability"
aliases: ["CVE-2022-24086"]
title: "Adobe Commerce and Magento Open Source: Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability"
severity: "critical"
cvss: 10.0
epss: 0.99199
exploited: true
status: "open"
category: "runtime"
products: [{"name": "Adobe Commerce and Magento Open Source", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["adobe-commerce", "exploited", "magento", "php", "runtime", "self-hosted"]
not_affected_if: ["managed-hosting", "unknown"]
published_at: "2022-02-15T00:00:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-24086", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-24086", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24086", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Adobe Commerce and Magento Open Source: Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability

Adobe Commerce and Magento Open Source contain an improper input validation flaw that lets an attacker run arbitrary code on the store server. CISA lists it as actively exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Adobe Commerce and Magento Open Source affected ? fixed ?

## Fix

Apply the updates per Adobe's vendor instructions; the sources do not name the fixed version.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-24086
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2022-24086
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-24086

## From the sources

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_