Zero Day Vulnerability Identified In Magento 2 And Adobe Commerce (CVE-2022-24086)

We would like to bring your attention to the following 0-day exploit we have recently become aware of.

A zero day remote code-execution (RCE) bug in the Magento 2 and Adobe Commerce platforms has been discovered. This vulnerability has been seen to be actively exploited in the wild.

Affected Versions (Both eCommerce Platforms)

• 2.3.7-p2 and earlier

• 2.4.3-p1 and earlier

This vulnerability has been rated as 9.8 out of 10 on the CVSS vulnerability scale. The vulnerability is triggered by improper input validation during the checkout process.

To exploit the vulnerability in its present form, an attacker would need to have administrative privileges in order to be successful.

Remediation

Patches have been made available from Adobe Directly.

• If you are running Magento 2.3 or 2.4, install the custom patch from Adobe.

• If you are running a version of Magento 2 between 2.3.3 and 2.3.7, you should be able to manually apply the patch.

Versions of Magento 2.3.3 or below, are not directly vulnerable. However, it is advisable to apply this patch to ensure any future weaknesses identified are mitigated.

References:

• https://support.magento.com/hc/en-us/articles/4426353041293-Security-updates-available-for-Adobe-Commerce-APSB22-12-

• https://helpx.adobe.com/security/products/magento/apsb22-12.html

• https://www.cvedetails.com/cve/CVE-2022-24086/

AI: The Great Equalizer in Cyber Offense

AI has erased the barrier between elite hackers and everyone else. From ransomware to large-scale extortion, attackers are now using AI to compress months of work…

Cobalt Strike External C2 Passthrough Guide

Cobalt Strike’s passthrough mode reshapes how red teams use External C2. By taking control of shellcode staging and custom channels, operators can bypass static detections and…

Part 2: CBEST Series – Operational Resilience

CBEST threat-led testing proves whether your organization can withstand real-world attacks, uncovering hidden weaknesses and driving true operational resilience.