Critical 9.8 KEV-listed

CVE-2024-34102

Security Auditing for Magento 2 Vulnerabilities

Vendor / product: Adobe Commerce and Magento Open Source

Victim organization: client store

Public PoC: Yes

First tracked by RiskWire: 2026-08-25

CISA KEV catalog

Added to KEV

2024-07-17 ↗

Federal remediation due

2024-08-07 (774 days overdue)

Ransomware campaign use

Unknown

CISA description

Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows for remote code execution.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Sources & citations (1)

gtstudio/magento-security-audit packagist.org · 2026-08-25

References

View on NVD ↗ View on MITRE CVE ↗ Search CISA ↗ KEV lookup tool

See CVE-2024-34102 in context

RiskWire tracks every exploited CVE this week, cross-referenced against CISA KEV with federal remediation deadlines. Filtered to your vendor stack.

Book a 20-min demo →