CVE Database · CVE-2022-24086
CVSS v3.1
9.8
EPSS
99.20%
Published
Feb 16, 2022
Modified
Oct 23, 2025
CISA Known Exploited Vulnerability
Added: 2022-02-15 · Due: 2022-03-01
Apply updates per vendor instructions.
Public PoC / Exploit (10)
All weaponized →Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.
Description
Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeaknesses (CWE)
Affected Products (14)
References (3)