CVE-2022-24086

This is a security bug in the checkout part of Adobe Commerce/Magento. Attackers can send specially crafted checkout inputs over the internet, without needing a login, to cause the system to run attacker-controlled code.

Think of it like a “front door” for purchases that has a broken lock: a hostile visitor can push the system into doing something it was never meant to do.

This matters if you run Adobe Commerce or Magento (including Magento Open Source / Magento Commerce / Magento Community Edition) and your installed version is 2.4.3-p1 or earlier, or 2.3.7-p2 or earlier. The risk does not depend on whether customers are logged in; the attacker does not need authentication and there is no required user interaction.

This is only a risk if your exposed checkout area is reachable over the network (i.e., accessible from the internet or other untrusted networks).

This is RED because it is a critical remote code execution flaw and it is listed in CISA KEV, meaning it has been treated as actively relevant for real-world defense. The vulnerability is reachable over the network without authentication, so an attacker does not need a special position or a user to click anything.

Because the fix exists and the KEV due date has passed, you should prioritize patching as the next immediate security work item.

1. Confirm our product + exact version

   • Identify which storefront software we run: Adobe Commerce or one of the Magento distributions listed (magento/community-edition, magento open source, magento commerce, etc.).
   • Determine the exact installed version.
   • Treat us as affected if we are at or before:
     • 2.4.3-p1 (or earlier)
     • 2.3.7-p2 (or earlier)

2. Upgrade to the vendor-fixed versions

   • If we are on “commerce” or “magento” builds, upgrade to 2.3.0.
   • If we are on “magento/community-edition,” upgrade to 2.3.7-p3 (or later).
   • Follow the vendor’s remediation instructions from the APSB bulletin (Adobe’s page linked in the findings).

3. Validate after upgrade

   • Re-check the installed version matches the fixed build.
   • Exercise the checkout process (including fields that accept user input) to ensure there are no regressions.

4. If patching must be delayed

   • Reduce exposure immediately by ensuring checkout endpoints are not reachable from the public internet.
   • Use network controls (IP allowlists, firewall rules, reverse-proxy restrictions) so only trusted traffic can reach the checkout functionality.
   • Track the upgrade as a high-priority item until completed.

5. What to monitor

   • Review web/app logs for unusual requests targeting checkout endpoints.
   • Watch for unexpected changes to application files or unusual process executions around checkout activity.

CISA due date (from KEV): 2022-03-01. Since this is long past, the expectation is to remediate now.

Severity: critical remote code execution (CWE-20: improper input validation).

Mechanism: Improper input validation during the checkout process allows an attacker to provide crafted network requests that can cause arbitrary code execution.

Reachability: Network-based attack with no authentication and no user interaction required (per findings).

Exploitation status: Listed in CISA KEV (added 2022-02-15) with a remediation due date of 2022-03-01, indicating it is treated as a real, actionable threat for defenders.

Exploit maturity: Not directly detailed beyond the KEV listing; exploit/weaponization info is not provided in the findings.

EPSS: A very high predicted likelihood is listed, but public reporting here is not included because KEV already establishes confirmed relevance for remediation.