Magento Commerce - RCE (CVE-2022-24086)
Description
Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.
psychologyCrowdSec Analysis
CVE-2022-24086 is a critical improper input validation vulnerability in Adobe Commerce (Magento Commerce) that affects the checkout process. This flaw allows remote attackers to execute arbitrary code on the server without requiring any user interaction, potentially leading to full system compromise and enabling a range of attacks such as data theft, site defacement, or malware deployment.
CrowdSec has been tracking this vulnerability and its exploits since 29th of October 2025.
CrowdSec has not observed any significant exploitation activity targeting CVE-2022-24086 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit the Adobe Commerce (Magento) checkout and payment API endpoints, particularly targeting /rest/default/V1/guest-carts/<entity_id>/shipping-information and /rest/default/V1/guest-carts/<entity_id>/payment-information, injecting malicious payloads in JSON fields to achieve remote code execution. These attempts often include suspicious template filter expressions or system command patterns within the firstname or lastname fields.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CISA KEV | 2022-02-15 |
| CVE Published | 2022-02-16 |
| CISA Remediation Deadline | 2022-03-01 |
| Rule Released | 2025-10-29 |
| CrowdSec First Seen | 2025-11-06 |