{"id":"CVE-2022-24086","published":"2022-02-16T17:15:13Z","modified":"2026-06-17T04:31:16Z","title":"Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability","vendor":"Adobe","product":"Commerce and Magento Open Source","tier":"core","eol":null,"description":{"text":"Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.","provenance":"source","from":"NVD"},"summary":{"text":"Adobe Commerce and Magento Open Source contain an improper input validation flaw in the checkout process. An unauthenticated remote attacker, without any user interaction, can exploit it to achieve arbitrary code execution.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:11:48Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99199,"percentile":0.99934,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2022-02-15","dueDate":"2022-03-01","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2022-24086","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-02-14","exploitedFirstSeen":"2022-02-14","ransomware":false,"evidence":[{"url":"https://www.bleepingcomputer.com/news/security/emergency-magento-update-fixes-zero-day-bug-exploited-in-attacks/","date":"2022-02-14"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-02-15"},{"url":"https://sansec.io/research/vendors-defeat-magento-security-patch-simple-check","date":"2023-01-16"},{"url":"https://www.akamai.com/blog/security-research/new-sophisticated-magento-campaign-xurum-webshell","date":"2023-08-09"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-14&host_type=src&vulnerability=cve-2022-24086","date":"2024-02-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-15&host_type=src&vulnerability=cve-2022-24086","date":"2024-02-15"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-16&host_type=src&vulnerability=cve-2022-24086","date":"2024-02-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-17&host_type=src&vulnerability=cve-2022-24086","date":"2024-02-17"},{"url":"https://research.checkpoint.com/2024/magnet-goblin-targets-publicly-facing-servers-using-1-day-vulnerabilities/","date":"2024-03-08"},{"url":"https://blog.checkpoint.com/security/april-2024s-most-wanted-malware-surge-in-androxgh0st-attacks-and-the-decline-of-lockbit3/","date":"2024-05-09"}],"evidenceTotal":19,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"https://helpx.adobe.com/security/products/magento/apsb22-12.html","tags":["Patch","Release Notes","Vendor Advisory"]},{"url":"https://helpx.adobe.com/security/products/magento/apsb22-12.html","tags":["Patch","Release Notes","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24086","tags":["Third Party Advisory","US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Input Validation","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability can be exploited via a public-facing e-commerce application in order to achieve remote code execution. To evade detection, the exploit segment responsible for downloading and executing the remote malicious PHP code is obfuscated.","confidence":"high"},{"id":"T1027","name":"Obfuscated Files or Information","tactics":["stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Input Validation","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability can be exploited via a public-facing e-commerce application in order to achieve remote code execution. To evade detection, the exploit segment responsible for downloading and executing the remote malicious PHP code is obfuscated.","confidence":"high"},{"id":"T1213","name":"Data from Information Repositories","tactics":["collection"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Input Validation","mappingType":"secondary_impact","evidence":[],"comment":"This vulnerability can be exploited via a public-facing e-commerce application in order to achieve remote code execution. To evade detection, the exploit segment responsible for downloading and executing the remote malicious PHP code is obfuscated.","confidence":"high"}],"reports":[],"affected":[{"ecosystem":"Packagist","package":"magento/community-edition","vulnerableRanges":[">=2.3.3-p1, <2.3.7-p3",">=2.4.0, <2.4.3-p2"],"patched":["2.3.7-p3","2.4.3-p2"],"from":["GHSA-f8fv-f786-9933"],"provenance":"source"}],"advisories":[{"id":"GHSA-f8fv-f786-9933","url":"https://github.com/advisories/GHSA-f8fv-f786-9933","severity":"CRITICAL","ecosystem":"Packagist","package":"magento/community-edition","vulnerableRanges":[">=2.3.3-p1, <2.3.7-p3"],"patched":["2.3.7-p3"],"provenance":"source","from":"GHSA"},{"id":"GHSA-f8fv-f786-9933","url":"https://github.com/advisories/GHSA-f8fv-f786-9933","severity":"CRITICAL","ecosystem":"Packagist","package":"magento/community-edition","vulnerableRanges":[">=2.4.0, <2.4.3-p2"],"patched":["2.4.3-p2"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-0975","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-0975","exploited":true,"exploitedSince":"2022-02-15","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":8,"skipped":1,"earliest":"2022-02-20","earliestUrl":"https://github.com/Mr-xn/CVE-2022-24086","repos":[{"name":"Mr-xn/CVE-2022-24086","url":"https://github.com/Mr-xn/CVE-2022-24086","stars":35,"created":"2022-02-20"},{"name":"oK0mo/CVE-2022-24086-RCE-PoC","url":"https://github.com/oK0mo/CVE-2022-24086-RCE-PoC","stars":6,"created":"2022-05-19"},{"name":"pescepilota/CVE-2022-24086","url":"https://github.com/pescepilota/CVE-2022-24086","stars":6,"created":"2022-12-20"},{"name":"seymanurmutlu/CVE-2022-24086-CVE-2022-24087","url":"https://github.com/seymanurmutlu/CVE-2022-24086-CVE-2022-24087","stars":2,"created":"2022-06-12"},{"name":"akr3ch/CVE-2022-24086","url":"https://github.com/akr3ch/CVE-2022-24086","stars":2,"created":"2022-10-01"}]},"nuclei":[{"id":"CVE-2022-24086","name":"Adobe Commerce (Magento) - Remote Code Execution","severity":"critical","path":"http/cves/2022/CVE-2022-24086.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24086.yaml"}],"first":{"date":"2022-02-20","source":"PoC-in-GitHub","url":"https://github.com/Mr-xn/CVE-2022-24086"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1027"],"provenance":"source"},{"stage":"secondary","techniques":["T1213"],"provenance":"source"}],"timeline":[{"date":"2022-02-14","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.bleepingcomputer.com/news/security/emergency-magento-update-fixes-zero-day-bug-exploited-in-attacks/","provenance":"source"},{"date":"2022-02-15","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-02-15","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-0975","provenance":"source"},{"date":"2022-02-16","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24086","provenance":"source"},{"date":"2022-02-20","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/Mr-xn/CVE-2022-24086","provenance":"source"}],"speed":{"daysToPublicExploit":4,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":69.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1718 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9993"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"8 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2021-39864","published":"2021-10-15","fixed":"2.3.7-p2","kev":false,"link":{"from":"CVE-2021-39864","to":"CVE-2022-24086","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:magento/community-edition","fromFixed":"2.3.7-p2","toFixed":"2.3.7-p3","daysApart":124}]}},{"cve":"CVE-2021-36042","published":"2021-09-01","fixed":"2.4.2-p2","kev":false},{"cve":"CVE-2021-36043","published":"2021-09-01","fixed":"2.4.2-p2","kev":false},{"cve":"CVE-2021-36044","published":"2021-09-01","fixed":"2.4.2-p2","kev":false},{"cve":"CVE-2022-24086","published":"2022-02-16","fixed":"2.4.3-p2","kev":true},{"cve":"CVE-2022-24093","published":"2023-09-12","fixed":"2.4.3-p2","kev":false},{"cve":"CVE-2022-35692","published":"2022-08-19","fixed":"2.4.3-p3","kev":false},{"cve":"CVE-2022-35689","published":"2022-10-14","fixed":"2.4.4-p2","kev":false}],"package":"Packagist:magento/community-edition"}}