CVE-2024-20720

—

CVSS 3.1

9.1 critical

EPSS

4%p89

Published

Feb 15, 2024 (Feb 15, 2024)

Modified

Jun 17, 2026

Description

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction.

Vendors: adobe
Products: commerce
Ecosystems: E-commerce
Weakness: CWE-78
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (3.7%)

In the news5 stories

Persistent Magento backdoor hidden in XML

Sansec (Magento / e-commerce security)Apr 14, 20:16 UTC · Apr 14, 2026Malware in the wildCVE-2024-20720 CVE-2026-75650

Hackers Exploit Magento Bug to Steal Payment Data from E

The Hacker NewsApr 6, 09:43 UTC · Apr 6, 2024Vulnerability CVE-2024-20720

Threat actors are exploiting critical Magento vulnerability CVE-2024-20720 to install a persistent backdoor on e

Security AffairsApr 5, 20:41 UTC · Apr 5, 2024Vulnerability CVE-2024-20720

Adobe Patch Tuesday fixed critical vulnerabilities in Magento, Acrobat and Reader

Security AffairsFeb 14, 09:25 UTC · Feb 14, 2024Vulnerability in the wildCVE-2024-20726 CVE-2024-20727 CVE-2024-20728+15 CVEs

Over 1,000 WordPress Sites Infected with JavaScript Backdoors Enabling Persistent Attacker Access

The Hacker NewsMar 27, 05:52 UTC · Mar 27, 2025Malware CVE-2024-34102 CVE-2024-20720