CosmicSting attack threatens 75% of Adobe Commerce stores
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-2961 | The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the… | 7.3 | 88% | ||
| CVE-2024-34102 | XXE vulnerability enabling RCE in Adobe Commerce and Magento Open Source | 9.8 | 100% | KEVPoC | KEV |
| CVE-2026-75650 | Unauthenticated Template Injection RCE in Adobe Commerce and Magento (CVE-2026-75650) | 10.0 | 4% | KEVPoC ×2 | KEV |
From the original article
2 min read at sansec.io
CosmicSting (aka CVE-2024-34102) is the worst bug to hit Magento and Adobe Commerce stores in two years. In itself, it allows anyone to read private files (such as those with passwords). However, combined with the recent iconv bug in Linux , it escalates into remote code execution.
By Sansec Forensics Team · sansec.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.