CVE-2022-24086

9.8 criticalKEVEPSS 99%

Critical (9.8) in Adobe Commerce and Magento Open Source. In CISA KEV since 2022-02-15. EPSS 99% chance of exploitation in the next 30 days.

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 99% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CISA KEV: listed 2022-02-15, due 2022-03-01
CWE: CWE-20
Published: 2022-02-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

adobe:commerce
adobe:magento

References

https://helpx.adobe.com/security/products/magento/apsb22-12.html
https://helpx.adobe.com/security/products/magento/apsb22-12.html
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24086

Check your stack JSON