UpHeron
All vulnerabilities

Servers and applications

CVE-2022-24086

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 15 Feb 2022.

Severity
Critical 9.8
Published
16 Feb 2022
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
2.3.0
Sources
NVD

Affected software

SoftwareAffected versions
Magento / Adobe CommerceServers and applications · cpe:a:adobe:commerce
  • Version 2.4.3-p1
  • Version 2.4.3
  • From 2.4.0 up to 2.4.2
  • Version 2.3.7-p2
All 7 release lines
  • Every version before 2.3.0
  • From 2.3.3 up to 2.3.6
  • Version 2.3.7-p1
  • Version 2.3.7-p2
  • From 2.4.0 up to 2.4.2
  • Version 2.4.3
  • Version 2.4.3-p1
Magento / Adobe CommerceServers and applications · cpe:a:adobe:magento
  • Version 2.4.3-p1
  • Version 2.4.3
  • From 2.4.0 up to 2.4.2
  • Version 2.3.7-p2
All 7 release lines
  • Every version before 2.3.0
  • After 2.3.3 up to 2.3.6
  • Version 2.3.7-p1
  • Version 2.3.7-p2
  • From 2.4.0 up to 2.4.2
  • Version 2.4.3
  • Version 2.4.3-p1

Known exploited

CISA name
Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability
Required action
Apply updates per vendor instructions.
Due for US agencies
1 Mar 2022
Used in ransomware
Not known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-24086
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-24086