Unauthenticated Remote Code Execution in Magento 2 and Adobe Commerce Systems (CVE-2022-24086)
A unauthenticated remote code-execution (RCE) bug in the Magento 2 and Adobe Commerce platforms was originally discovered in February 2022.
A unauthenticated remote code-execution (RCE) bug in the Magento 2 and Adobe Commerce platforms was originally discovered in February 2022.
We would like to update you on to the following exploit.
A unauthenticated remote code-execution (RCE) bug in the Magento 2 and Adobe Commerce platforms was originally discovered in February 2022. This vulnerability has been seen to be actively exploited in a new surge of attacks.
This vulnerability has been rated as 9.8 out of 10 on the CVSS vulnerability scale.
The vulnerability is triggered by improper input validation during the checkout process.
An attacker is able to exploit this vulnerability without being authenticated on the web application (contrary to what previously has been reported). Several methods to exploit the vulnerability were published. A Proof of Concept (PoC) also has been made available to the public.
Patches have been made available from Adobe Directly.
Versions of Magento 2.3.3 or below are not directly vulnerable. However, it is advised to apply this patch to ensure any future weaknesses identified are mitigated.
Inside a Red Team OSINT Operation: Mapping the Human Attack Surface
Most organizations focus on infrastructure. Red teams target people. We explore how OSINT is used to map the human attack surface, and why mid-level employees often…
Atlas AI: Local LLM inside Burp Suite
Atlas AI adds LLM-powered analysis to Burp Suite without sending data to the cloud. Built for offensive security teams who need full local control.
Redefining Cybersecurity Value: A CFO’s Take on ROI and Resilience
Cybersecurity is how modern businesses grow with confidence. But only if that investment is tested, validated, and aligned to what really matters.