Cyber Resilience

CVE-2022-24086

CriticalCISA KEVActive ExploitationEUVD Exploited

Published: 16 February 2022

Published
16 February 2022
Modified
23 October 2025
KEV Added
15 February 2022
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.9370 99.9th percentile
Risk Priority 96 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-24086 is a critical-severity Improper Input Validation (CWE-20) vulnerability in Adobe Commerce. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

Adobe Commerce versions 2.4.3-p1 and earlier along with 2.3.7-p2 and earlier contain an improper input validation flaw (CWE-20) in the checkout process. The issue carries a CVSS 3.1 score of 9.8 and stems from insufficient validation of untrusted data supplied during order processing.

An unauthenticated attacker can send specially crafted input over the network to trigger arbitrary code execution on the affected server without any user interaction. Successful exploitation grants the attacker full control over the application and underlying system.

Adobe’s security bulletin APSB22-12 details the affected releases and directs customers to apply the supplied patches. The vulnerability is also catalogued in CISA’s Known Exploited Vulnerabilities list, confirming observed in-the-wild use.

The associated EPSS score has remained consistently high, reaching a peak of 0.9385, indicating sustained exploitation interest since disclosure.

EU & UK References

Vulnerability details

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.

CWE(s)
CWE-20
KEV Date Added
15 February 2022

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

adobe
commerce
2.3.7, 2.4.3 · ≤ 2.3.0 · 2.3.3 — 2.3.6 · 2.4.0 — 2.4.2
adobe
magento
2.3.7, 2.4.3 · ≤ 2.3.0 · 2.3.3 — 2.3.6 · 2.4.0 — 2.4.2

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires validation of all input to the checkout process, blocking the crafted payloads that trigger arbitrary code execution in this CVE.

SI-2 Flaw Remediation good match
prevent

Mandates timely application of vendor patches for the known input-validation flaw listed in APSB22-12 and CISA KEV.

RA-5 Vulnerability Monitoring and Scanning partial match
detect

Requires continuous vulnerability scanning to identify unpatched Adobe Commerce instances susceptible to this unauthenticated RCE.

References