Black Friday60% off BLACKFRIDAY2026
Platform
PlansPartners
Resources
ToolsBlogDocs
Labs
CVE ForecastOpservantAll Research →
Sign Up →
🔴
CISA Known Exploited Vulnerability
This CVE is actively exploited in the wild. CISA mandates federal agencies to patch immediately.
CVE

CVE-2022-24086

9.8
CVSScritical
Exploitable remotely over the internet · no authentication required.
Description

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.

Attack Vector
Network
Privileges Req.
None
User Interaction
None
magento commerce
Updated Nov 10, 2026View on NVD →
S4E scanner

Adobe Commerce (Magento) - Remote Code Execution

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution. References: https://helpx.adobe.com/security/products/magento/apsb22-12.html https://vovohelo.medium.com/reversing-a-magento-rce-cve-2022-24086-e991ead4d8af https://labs.watchtowr.com/adobe-commerce-magento-rce-cve-2022-24086/ https://nvd.nist.gov/vuln/detail/CVE-2022-24086 Remediation: Update to the latest version of Adobe Commerce that addresses this vulnerability.

Used 20 times · 10 assets checked · domain, subdomain, ipv4

CVE history: magento commerce

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →