CRITICAL🚩 CISA KEV⚡ EXPLOIT🇵🇱 Wersja polska

CVE-2022-24086

CVSS 9.8v3.1pub. 2022-02-16upd. 2025-10-23

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Adobe Commerce

    APP
    Adobe
    2.3.72.4.32.3.3 – 2.3.62.4.0 – 2.4.2< 2.3.0

  • Adobe Magento

    APP
    Adobe
    2.3.72.4.32.4.0 – 2.4.2≤ 2.3.6< 2.3.0

CISA KEV — detailsi

Vendori
Adobe ↗
Producti
Commerce and Magento Open Source
Added to KEVi
February 15, 2022
Remediation deadline (US Federal)i
March 1, 2022(overdue)
Required action (CISA)i

Apply updates per vendor instructions.

CISA descriptioni

Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution.

🔴
IMMEDIATE ACTION
Actively exploited in the wild (CISA KEV). Patch immediately.
⏰CISA DEADLINE: 1 marca 2022
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2025-54236CRITICAL9.1⚠ KEVPL ✓same product

Adobe Commerce/Magento — przejęcie sesji przez Improper Input Validation

CVE-2024-34102CRITICAL9.8⚠ KEVPL ✓same product

Krytyczna podatność XXE w Adobe Commerce umożliwiająca RCE

CVE-2026-48356CRITICAL9.3PL ✓same product

Adobe Commerce — nieograniczony upload pliku umożliwiający RCE

CVE-2026-48358CRITICAL9.1PL ✓same product

RCE w Adobe Commerce — błąd kodowania wyjścia (CVE-2026-48358)

CVE-2025-24434CRITICAL9.1PL ✓same product

Adobe Commerce — Incorrect Authorization umożliwiające privilege escalation