Adobe has published an emergency out-of-band security bulletin and update to fix a critical vulnerability within Adobe’s Commerce and Magento Open-Source products. These two Adobe cloud solutions allow administrators to manage e-commerce websites and other online marketplaces. The technical details about the flaw, tracked as CVE-2022-24086, are not publicly available at this time. Adobe has stated that the root cause of the vulnerability is an improper input validation. If this vulnerability is exploited, it facilitates unauthenticated attackers to perform remote code execution (RCE) on targeted systems. E-commerce sites are very valuable to financially motivated threat actors because of the potential to illegally harvest payment card data through attacks known as web skimmers or Magecart attacks. Just last week, Sansec, an e-commerce malware and vulnerability detection firm disclosed a Magecart attack that compromised more than 500 Magento based e-commerce websites. The vulnerable Adobe Commerce versions are 2.3.7-p2 and earlier. The vulnerable versions of Adobe Magento are 2.4.3-p1 and earlier. Administrators are urged to download the patch immediately to mitigate this vulnerability and secure their e-commerce sites. In a RiskIQ report published this February, it states that 165 unique command-and-control (C2) servers and skimmers were used in Magecart attacks this January. The Ankura CTIX will be monitoring the fallout of this flaw, and relevant updates will be published for our readers in the future.