← CVE Radar
CVE-2022-24086Adobe Commerce checkout improper input validation leads to remote code execution
Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.
9.8 CRITICALEPSS 99.19%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.8 | CRITICAL | 3.1adobe (CNA) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 10.0 | HIGH | 2.0NVD | AV:N/AC:L/Au:N/C:C/I:C/A:C |
CISA required action
⚡ Known exploited · remediation due Mar 1, 2022
Apply updates per vendor instructions.
Details
- CVE ID
- CVE-2022-24086
- Status
- Analyzed
- Assigner (CNA)
- adobe
- Published
- Feb 16, 2022
- Last modified
- 2026-06-17 04:31 UTC
- Weaknesses
- CWE-20 · Improper Input Validation (CWE-20)
Affected Products
As published by the CNA in the CVE record.
AdobeMagento Commerce3 version ranges
- through 2.4.3-p1
- through 2.3.7-p2
- through None