Actively exploited in the wild
Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability
Adobe - Commerce and Magento Open Source · Listed in the CISA KEV since 2022-02-15. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2022-24086
CriticalCVSS 9.8KEVSummary
Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation does not require user interaction and could result in arbitrary code execution.
Risk Assessment
An attacker can remotely execute arbitrary code on the store server, potentially leading to theft of customer data, order manipulation, or full compromise of the e-commerce platform. The flaw is easy to exploit without user involvement.
Recommendation
Immediately update Adobe Commerce to the latest patched version. Review logs for unusual checkout requests and verify system integrity.
Other vulnerabilities in Adobe Commerce
See all- CVE-2026-76201Critical
Adobe Commerce is affected by a stored XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
- CVE-2026-76200Critical
Adobe Commerce is affected by a stored XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
- CVE-2026-75650CriticalActively exploited
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation does not require user interaction. Scope is changed.
- CVE-2026-71362Critical
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.
- CVE-2026-48358Critical
Adobe Commerce is affected by an Improper Encoding or Escaping of Output vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability without user interaction. The scope of the vulnerability has changed.
- CVE-2026-48356Critical
Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. This could allow an attacker to gain elevated access or control over the victim's account or session. Exploitation requires user interaction, such as visiting a maliciously crafted URL or interacting with a compromised web page.
- CVE-2026-34650High
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources.
- CVE-2026-34649High
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources.
- CVE-2026-34648High
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources.
- CVE-2025-54236CriticalActively exploited
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, significantly impacting confidentiality and integrity.
Original NVD description (English source)
Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.