CVE Watch—

CVE-2024-34102

Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability

CVSS

—

No CVSS

EPSS

100.0%

p100

KEV

YES

Jul 17, 2024

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

100.0%EPSS · 30 days100.0%

2026-09-162026-10-14

KEV catalog record

Product

Adobe / Commerce and Magento Open Source

Vulnerability

Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability

Added to KEV

Jul 17, 2024

Remediate by

Aug 7, 2024

Known ransomware use

Summary description

Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows for remote code execution.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://helpx.adobe.com/security/products/magento/apsb24-40.html; https://nvd.nist.gov/vuln/detail/CVE-2024-34102

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2022-24086—

99.9%

KEV—80Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability—