CVE-2022-24086

CRITICAL KEV NUCLEI LAB

Adobe Commerce <2.4.3-p1, <2.3.7-p2 - RCE

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2022-24086 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added February 15, 2022. EIP tracks 10 public exploits from researchers including Mr-xn, oK0mo, pescepilota. A Nuclei detection template is also available.

AI-analyzed exploit summary The repository provides a description and a template injection payload for CVE-2022-24086, an RCE vulnerability in Adobe Commerce (Magento). However, it explicitly states that the provided POC is not the true exploit, and no functional exploit code is included.

Description

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.

Exploits (10)

nomisec WRITEUP 36 stars
by Mr-xn · infoleak
https://github.com/Mr-xn/CVE-2022-24086

The repository provides a description and a template injection payload for CVE-2022-24086, an RCE vulnerability in Adobe Commerce (Magento). However, it explicitly states that the provided POC is not the true exploit, and no functional exploit code is included.

Classification
Writeup 80%
Attack Type
Rce
Complexity
Moderate
Reliability
Theoretical
Target: Adobe Commerce (Magento) versions 2.4.3-p1 and earlier, 2.3.7-p2 and earlier
No auth needed
Prerequisites: Access to a vulnerable Magento instance during the checkout process
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WRITEUP 7 stars
by oK0mo · poc
https://github.com/oK0mo/CVE-2022-24086-RCE-PoC

This repository provides a technical analysis of CVE-2022-24086, an Improper Input Validation vulnerability in Adobe Commerce and Magento Open Source. It details the patch analysis, affected versions, and the mechanism involving email template filters but does not include functional exploit code.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Theoretical
Target: Adobe Commerce / Magento Open Source 2.3.3-p1 - 2.3.7-p2, 2.4.0 - 2.4.3-p1
No auth needed
Prerequisites: Access to email template functionality in Magento/Adobe Commerce
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 5 stars
by pescepilota · remote
https://github.com/pescepilota/CVE-2022-24086

This PoC demonstrates an RCE vulnerability in Magento 2.4.3 via template injection in order fields, leveraging a callback function to execute arbitrary system commands. The payload uses a reverse shell via netcat to demonstrate exploitation.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Magento 2.4.3
Auth required
Prerequisites: Access to Magento order creation/modification · Template injection in order fields
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 2 stars
by akr3ch · poc
https://github.com/akr3ch/CVE-2022-24086

This PoC demonstrates a template injection vulnerability in Adobe ColdFusion, allowing arbitrary code execution via the `getTemplateFilter().addAfterFilterCallback` method. The provided payload executes the `whoami` command as a proof of concept.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Adobe ColdFusion (versions affected by CVE-2022-24086)
No auth needed
Prerequisites: Access to a vulnerable ColdFusion instance
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WRITEUP 2 stars
by seymanurmutlu · poc
https://github.com/seymanurmutlu/CVE-2022-24086-CVE-2022-24087

This repository contains a README referencing a blog post about Magento and Adobe Commerce RCE vulnerabilities CVE-2022-24086 and CVE-2022-24087. No exploit code is present, only a link to an external PDF document.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Theoretical
Reliability
Theoretical
Target: Magento and Adobe Commerce
No auth needed
Prerequisites: Access to the referenced PDF for detailed exploit information
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by wubinworks · poc
https://github.com/wubinworks/magento2-template-filter-patch

This repository contains a patch for CVE-2022-24086, a template injection vulnerability in Magento 2. The code includes escaping and filtering mechanisms to mitigate the vulnerability by sanitizing user input in template filters.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Magento 2 (Adobe Commerce)
No auth needed
Prerequisites: Access to a vulnerable Magento 2 instance with exposed template filters
devstral-2 · analyzed Feb 16, 2026 Full analysis →
github WRITEUP
by iitsmel · htmlpoc
https://github.com/iitsmel/Research/tree/main/CVE-2022-24086

This repository provides a detailed analysis of CVE-2022-24086, including references to official sources, patch information, and related GitHub issues. It does not contain exploit code but offers technical context and links to relevant resources.

Classification
Writeup 90%
Attack Type
Other
Complexity
N/a
Reliability
N/a
Target: Adobe Commerce / Magento
No auth needed
devstral-2 · analyzed Apr 29, 2026 Full analysis →
nomisec WRITEUP
by BurpRoot · remote
https://github.com/BurpRoot/CVE-2022-24086

The repository provides a detailed writeup and a basic proof-of-concept (PoC) for CVE-2022-24086, a critical Server-Side Template Injection (SSTI) vulnerability in Magento2. The PoC demonstrates how an attacker can inject malicious template code to execute arbitrary commands, such as retrieving the server hostname.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Magento2 versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier)
No auth needed
Prerequisites: Access to a vulnerable Magento2 instance · Ability to inject template code via user input (e.g., checkout process)
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SUSPICIOUS
by NHPT · poc
https://github.com/NHPT/CVE-2022-24086-RCE

The repository claims to provide an exploitation tool for CVE-2022-24086 (Magento RCE) but only contains a README advertising a paid tool. No actual exploit code is provided, raising suspicions of a potential scam or trojan.

Classification
Suspicious 90%
Attack Type
Rce
Complexity
Theoretical
Reliability
Theoretical
Target: Adobe Magento (versions affected by CVE-2022-24086)
No auth needed
Prerequisites: potentially vulnerable Magento instances
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WRITEUP
by nanaao · remote
https://github.com/nanaao/CVE-2022-24086-RCE

This repository contains a writeup and images describing CVE-2022-24086, an RCE vulnerability in Adobe Commerce due to improper input validation during checkout. No exploit code is provided, only documentation.

Classification
Writeup 80%
Attack Type
Rce
Complexity
Moderate
Reliability
Theoretical
Target: Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier)
No auth needed
Prerequisites: Access to the checkout process of a vulnerable Adobe Commerce instance
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

Adobe Commerce (Magento) - Remote Code Execution
CRITICALVERIFIEDby daffainfo
Shodan: X-Magento-Tags

References (2)

Core 2
Core References
Patch, Release Notes, Vendor Advisory x_refsource_misc
https://helpx.adobe.com/security/products/magento/apsb22-12.html

Scores

CVSS v3 9.8
EPSS 0.9370
EPSS Percentile 99.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable yes
Technical Impact total

Lab Environment

COMMUNITY
Community Lab
docker pull docker.io/bitnami/magento:2.4.3-debian-10-r0
docker pull docker.io/bitnami/elasticsearch:7
+7 more repos

Details

CISA KEV 2022-02-15
VulnCheck KEV 2022-02-14
InTheWild.io 2022-02-14
ENISA EUVD EUVD-2022-0975
CWE
CWE-20
Status published
Products (7)
adobe/commerce 2.3.7 p1 (2 CPE variants)
adobe/commerce 2.4.3 (2 CPE variants)
adobe/commerce < 2.3.0
adobe/magento 2.3.7 p1 (2 CPE variants)
adobe/magento 2.4.3 (2 CPE variants)
adobe/magento < 2.3.0
magento/community-edition 2.3.3-p1 - 2.3.7-p3Packagist
Published Feb 16, 2022
KEV Added Feb 15, 2022
Tracked Since Feb 18, 2026