CVE-2022-24086

Status: AnalyzedCritical (9.8)⚠ Active exploitation

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.

CVSS

Version: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base score: 9.8

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 99%
Percentile among all scored CVEs: 100
Score date: 9/29/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

CISA KEV — actively exploited

Added to catalog: 2/15/2022
Remediation due date: 3/1/2022
Known ransomware use: Unknown

Affected technologies (2)

Adobe — Commerce Adobe — Magento

CWEs

CWE-20

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2022-24086",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-24086",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-02-27T18:35:53.490758Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@adobe.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@adobe.com",
      "affectedData": [
        {
          "vendor": "Adobe",
          "product": "Magento Commerce",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "2.4.3-p1"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "2.3.7-p2"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "None"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-02-16T17:15:13.307",
  "references": [
    {
      "url": "https://helpx.adobe.com/security/products/magento/apsb22-12.html",
      "tags": [
        "Patch",
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "psirt@adobe.com"
    },
    {
      "url": "https://helpx.adobe.com/security/products/magento/apsb22-12.html",
      "tags": [
        "Patch",
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24086",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@adobe.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution."
    },
    {
      "lang": "es",
      "value": "Adobe Commerce versiones 2.4.3-p1 (y anteriores) y 2.3.7-p2 (y anteriores), están afectadas por una vulnerabilidad de comprobación de entrada inapropiada durante el proceso de compra. Una explotación de este problema no requiere la interacción del usuario y podría resultar en una ejecución de código arbitrario"
    }
  ],
  "lastModified": "2026-06-17T04:31:16.010",
  "cisaActionDue": "2022-03-01",
  "cisaExploitAdd": "2022-02-15",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "90B19F1A-11A1-4315-8433-6B8938228BF7",
              "versionEndExcluding": "2.3.0"
            },
            {
              "criteria": "cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CE057011-26D8-4298-8D24-624CCD26F014",
              "versionEndIncluding": "2.3.6",
              "versionStartIncluding": "2.3.3"
            },
            {
              "criteria": "cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6DFFF83C-2A52-442D-8349-7B37843B630F",
              "versionEndIncluding": "2.4.2",
              "versionStartIncluding": "2.4.0"
            },
            {
              "criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9F471E19-8AFE-4A6C-88EA-DF94428518F7"
            },
            {
              "criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "27E5B990-1E1C-46AC-815F-AF737D211C16"
            },
            {
              "criteria": "cpe:2.3:a:adobe:commerce:2.4.3:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7B503C35-8C90-4A24-8E60-722CDBBF556B"
            },
            {
              "criteria": "cpe:2.3:a:adobe:commerce:2.4.3:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8A453C85-A14A-47B8-B91D-3906BBE42A78"
            },
            {
              "criteria": "cpe:2.3:a:adobe:magento:*:*:*:*:open_source:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "67B41B1F-86FE-43A9-BE12-42F15F47446A",
              "versionEndExcluding": "2.3.0"
            },
            {
              "criteria": "cpe:2.3:a:adobe:magento:*:*:*:*:open_source:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9F0EBEC1-B55D-40FE-A649-969D7B2F5BA3",
              "versionEndIncluding": "2.3.6",
              "versionStartExcluding": "2.3.3"
            },
            {
              "criteria": "cpe:2.3:a:adobe:magento:*:*:*:*:open_source:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "59C7EB66-4DC7-40E5-AEA5-605A930E09EB",
              "versionEndIncluding": "2.4.2",
              "versionStartIncluding": "2.4.0"
            },
            {
              "criteria": "cpe:2.3:a:adobe:magento:2.3.7:p1:*:*:open_source:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B8BEB5B9-87A6-466B-AEA3-516025219219"
            },
            {
              "criteria": "cpe:2.3:a:adobe:magento:2.3.7:p2:*:*:open_source:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E8A5A54D-A2B8-4D3F-9F02-A8D60BFD52A7"
            },
            {
              "criteria": "cpe:2.3:a:adobe:magento:2.4.3:-:*:*:open_source:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "45FD678B-59DE-4F05-8BB3-A02F5EBA7414"
            },
            {
              "criteria": "cpe:2.3:a:adobe:magento:2.4.3:p1:*:*:open_source:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "431F341D-81A0-439F-B6D8-898E55FC1780"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@adobe.com",
  "cisaRequiredAction": "Apply updates per vendor instructions.",
  "cisaVulnerabilityName": "Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability"
}