Skip to content
NewA calmer, faster ZeroHour
VulnerabilitycriticalExploited in the wild

Magento 2 critical vulnerability (CVE-2022-24086 & CVE-2022

Sansec (Magento / e-commerce security)by Sansec Forensics Team ()2 min read3 · 1 read
Read at sansec.io
Analyze CVE-2022-24086 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2022-24086CVE-2026-75650CVE-2025-54236
Tags
cve-2022-24086cve-2025-54236cve-2026-75650vulnerability

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2022-24086
Unauthenticated RCE via checkout input-validation flaw in Adobe Commerce/Magento
9.899%KEV
KEV
CVE-2025-54236
Unauthenticated Session Takeover in Adobe Commerce and Magento (SessionReaper)
9.196%KEVPoC ×2
KEV
CVE-2026-75650
Unauthenticated Template Injection RCE in Adobe Commerce and Magento (CVE-2026-75650)
10.099%KEVPoC ×2
KEV

From the original article

2 min read at sansec.io

Update Feb 21st, 2022: Sansec has observed the first actual attacks in the wild. Patch now! Unfortunately, this validates our previous prediction that abuse would start within days.

Sansec (Magento / e-commerce security)

By Sansec Forensics Team · sansec.io

Read the full article at Sansec (Magento / e-commerce security)

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.