Skip to content

Unauthenticated Remote Code Execution in Magento 2 and Adobe Commerce Systems (CVE-2022-24086)

A unauthenticated remote code-execution (RCE) bug in the Magento 2 and Adobe Commerce platforms was originally discovered in February 2022.

  • Resources
  • Glossary
  • Unauthenticated Remote Code Execution in Magento 2 and Adobe Commerce Systems (CVE-2022-24086)

We would like to update you on to the following exploit.

A unauthenticated remote code-execution (RCE) bug in the Magento 2 and Adobe Commerce platforms was originally discovered in February 2022. This vulnerability has been seen to be actively exploited in a new surge of attacks.

Affected Versions (both eCommerce platforms)

  • 2.3.7-p2 and earlier
  • 2.4.3-p1 and earlier

This vulnerability has been rated as 9.8 out of 10 on the CVSS vulnerability scale.

The vulnerability is triggered by improper input validation during the checkout process.

An attacker is able to exploit this vulnerability without being authenticated on the web application (contrary to what previously has been reported). Several methods to exploit the vulnerability were published. A Proof of Concept (PoC) also has been made available to the public.

Remediation

Patches have been made available from Adobe Directly.

  • If you are running Magento 2.3 or 2.4, install the custom patch from Adobe.
  • If you are running a version of Magento 2 between 2.3.3 and 2.3.7, you should be able to manually apply the patch.

Versions of Magento 2.3.3 or below are not directly vulnerable. However, it is advised to apply this patch to ensure any future weaknesses identified are mitigated.

References:

Long-exposure shot of a crowded station concourse, with a static, illuminated information booth at the center while blurred figures move past in every direction.

You can’t keep up, so prioritize better.

Attackers don’t need to find every route in. They just need one. COO Luke Potter argues the fix isn’t more scanning. It’s vulnerability prioritization: focus research…
Graham Haythornthwaite joins CovertSwarm as Technical Director

CovertSwarm appoints Graham Haythornthwaite to accelerate its challenge to the offensive security industry

CovertSwarm has appointed Graham Haythornthwaite as Technical Director, effective September 1, 2026. A former CovertSwarm client turned technical leader, Graham joins as the company defines Continuous…
A single lit office window glows in an otherwise dark building at night, a monitor visible and unattended inside.

Patching isn’t the question anymore.

“Have we patched it?” isn’t the question your CISO is being asked anymore. AI is finding vulnerabilities faster than anyone can fix them, here’s the question…