UPDATE: Adobe has added a new critical zero-day vulnerability to their out-of-band security bulletin and update released last week. This new flaw is tracked as CVE-2022-24087, and is also an improper input validation flaw, that if exploited would allow unauthenticated attackers to perform remote code execution (RCE) on e-commerce websites employing Adobe’s vulnerable Commerce and Magento Open-Source instances. This exploitation would enable an attacker to steal customer payment information. The original bulletin from last week was for CVE-2022-24086, a vulnerability that had already been exploited in-the-wild at the time. Adobe patched the CVE-2022-24086 flaw however, it was patched inadequately, and as of February 17, 2022, security researchers from the Offensive Team at Positive Technologies tweeted proof that they have developed a reliable exploit that bypasses the patch and leads to the same RCE in multiple ways. Although these are both critical zero-day flaws, Positive Technologies has provided the context that these exploits are especially difficult to execute correctly, and that even the original flaw (CVE-2022-24086) had only been exploited a handful of times by very sophisticated hackers. Adobe has stated, “We have discovered additional security protections necessary for CVE-2022-24086 and have released an update to address them (CVE-2022-24087).” It is imperative for any site administrators and owners leveraging either of these products to update to the most secure version as soon as possible. The Ankura CTIX will continue to monitor this situation and will update our readers with more information if necessary.