CVE-2022-24086: Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-02-15. EPSS: 99.2% chance of exploitation in the next 30 days.

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.

Affected products

• Adobe Commerce: before 2.3.0 (fixed in 2.3.0); from 2.3.3, up to and including 2.3.6; from 2.4.0, up to and including 2.4.2; version 2.3.7 only; version 2.4.3 only
• Adobe Magento: before 2.3.0 (fixed in 2.3.0); after 2.3.3, up to and including 2.3.6; from 2.4.0, up to and including 2.4.2; version 2.3.7 only; version 2.4.3 only

Published 2022-02-16. Last modified 2026-06-17.