:quality(75))
Adobe has issued an urgent security advisory for a critical pre-authentication remote code execution vulnerability in Adobe Commerce and Magento Open Source. CVE-2022-24086 carries a CVSS score of 9.8 and is being actively exploited in the wild.
The detail
CVE ID: CVE-2022-24086
CVSS score: 9.8 (Critical)
Affected versions: all supported versions of Adobe Commerce and Magento Open Source
Type: pre-authentication remote code execution
Exploitation status: actively being exploited in the wild
Unauthenticated attackers can execute arbitrary code through a specific input vector. No credentials are needed — network access to the affected system is enough.
A CVSS score of 9.8 sits at the top end of what is possible, and pre-auth RCE is exactly what attackers look for first. Active exploitation means working exploits already exist and are being deployed. A compromise here means full system access and a data breach, customer and payment data gone, malware and persistent access, defacement and downtime, and the financial and reputational cost that follows.
What to do now
Adobe has released patches for all affected versions. Treat this as an incident, not a maintenance ticket.
On Adobe Commerce Cloud, Adobe is applying patches automatically. Check your environment status in the console and confirm they are current.
On self-hosted Adobe Commerce or Magento Open Source, download and apply the patches immediately. If your infrastructure cannot be patched right now, taking the system offline until it can is a reasonable call.
The patches are security-specific and do not require a full version upgrade, which keeps compatibility risk and downtime down. If you run custom code or extensions, verify compatibility before production. Most well-maintained third-party extensions will be fine, but check rather than assume.
After you have patched
Look for evidence you were already hit. Review web server access logs for suspicious requests, check system logs for unauthorised access, scan for malware and unfamiliar accounts, verify the integrity of critical system files, and review recent administrative activity. If anything looks wrong, bring in security professionals for forensics and remediation rather than guessing.
What this means for you
The patch closes this hole. The open question is whether the next one catches you the same way, and that is a process question rather than a technical one. How quickly can you deploy a security patch? Would log monitoring and intrusion detection tell you an exploitation attempt had happened? Do WAF rules block attempts at the edge? When did anyone last assess the platform? And has the incident response plan ever actually been run?
Better to answer those now than during the next advisory.