CVE-2024-20720

CVSS 3.1: 9.1 critical
EPSS: 4%p89
Published: Feb 15, 2024 · Feb 15, 2024
Modified: Jun 17, 2026

Analyze CVE-2024-20720 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction.

Vendors: adobe

Products: commerce

Ecosystems: E-commerce

Weakness: CWE-78

Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (3.7%)

In the news

5 stories

Persistent Magento backdoor hidden in XML

Sansec (Magento / e-commerce security)Apr 14, 20:16 UTC · Apr 14, 2026MalwareExploitedCVE-2024-20720 CVE-2026-756501

Hackers Exploit Magento Bug to Steal Payment Data from E

The Hacker NewsApr 6, 09:43 UTC · Apr 6, 2024VulnerabilityCVE-2024-207202 · 1 read

Threat actors are exploiting critical Magento vulnerability CVE-2024-20720 to install a persistent backdoor on e

Security AffairsApr 5, 20:41 UTC · Apr 5, 2024VulnerabilityCVE-2024-207202

Adobe Patch Tuesday fixed critical vulnerabilities in Magento, Acrobat and Reader

Security AffairsFeb 14, 09:25 UTC · Feb 14, 2024VulnerabilityExploitedCVE-2024-20726 CVE-2024-20727 CVE-2024-20728+152 · 1 read

Over 1,000 WordPress Sites Infected with JavaScript Backdoors Enabling Persistent Attacker Access

The Hacker NewsMar 27, 05:52 UTC · Mar 27, 2025MalwareCVE-2024-34102 CVE-2024-207201 · 1 read