:quality(75))
On 11 October 2022 Adobe shipped a coordinated set of security updates across the supported version lines, including 2.4.5-p1 and 2.4.4-p2. The detail sits in APSB22-48. The headline fix was a stored XSS, CVE-2022-35698, carrying a CVSS base score of 10.0, alongside a set of access-control issues.
Why it mattered
Stored XSS lets arbitrary JavaScript run in the browser context. In a weakly configured admin panel that is a route to credential theft and account takeover. A good CSP and 2FA narrow the window. Removing the vulnerability closes it.
Adobe also published a separate hotfix path for earlier releases affected by CVE-2022-35698. If your estate runs a mix of versions — long-lived integration environments are the usual culprit — each line needed its own remediation. Better still, bring those environments forward so there is one patch procedure to document.
What we would do
Apply the right p-line for your family, 2.4.5-p1 or 2.4.4-p2, then confirm the admin loads with the CSP headers you expect.
Check whether the standalone CVE-2022-35698 hotfix is needed anywhere non-standard, and plan it in before the next sprint starts.
Regression test payment methods, checkout and order placement. Verify webhooks and asynchronous payment flows still complete.
Check WAF rules and CSP allowlists so newly versioned assets are not blocked, and update integrity hashes where you use them.
Talk to your extension vendors. Confirm their compatibility declarations and read their release notes for post-patch fixes.
What this means for you
The lasting lesson from October 2022 is operational rather than technical. Security is a cadence, not a crisis. A quarterly patch window, lower environments kept in near-lockstep with production, and a lean automated test pack that catches the things that actually matter. That is the difference between a patch cycle and a fire drill.