CVE-2022-24086VulnerabilityPublished 02/15/2022Updated 10/24/2026

CVE-2022-24086: Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability

Affects Adobe Commerce and Magento Open SourceSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 02/15/2022
KEV deadline: 03/01/2022
EPSS: 99.2% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2022-24086 (opens in a new tab)

Description

CVE-2022-24086 is an improper input validation vulnerability in Adobe Commerce and Magento Open Source that can lead to arbitrary code execution. This vulnerability has been exploited in the wild, indicating active attacks. The severity is high due to the potential for attackers to execute arbitrary code on affected systems.

Summary

Adobe Commerce and Magento Open Source contain an improper input validation vulnerability (CWE-20) that allows attackers to execute arbitrary code. This vulnerability has been confirmed to be exploited in the wild, increasing its risk profile. No specific affected versions or patch information is provided in the available data. The vulnerability was publicly disclosed on February 15, 2022.

Impact

Successful exploitation of this vulnerability can result in arbitrary code execution, potentially allowing attackers to take control of affected systems. Given the exploitation in the wild, this represents a significant risk to organizations using affected versions of Adobe Commerce and Magento Open Source.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should monitor vendor communications closely and apply any recommended mitigations or workarounds provided by Adobe.

Weaknesses

CWE-20Improper Input Validation (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 10:11:46 UTC

Weaknesses

References

Related threats