Magento Vulnerabilities You Can't Ignore in 2026 (CVE List)
Most Magento hacks don't use zero-days — they exploit known, already-patched CVEs on stores that didn't patch fast enough. These are the Magento vulnerabilities attackers are actively weaponising in 2026, what versions they hit, and how to check whether your store is exposed.
Want the answer for your store in seconds? Run a free MageArgus scan — it maps your version to each of these and names the exact patch.
- CosmicSting alone led to thousands of mass-compromised stores — Sansec, 2024
- Each CVE is fixed at a different patch level per branch (2.4.4–2.4.8) — Adobe APSB bulletins
SessionReaper — CVE-2025-54236
An unauthenticated RCE / account-takeover bug in the Magento Web API (APSB25-94). Critical (CVSS 9.1). Fixed at 2.4.8-p3 / 2.4.7-p8 / 2.4.6-p13 / 2.4.5-p15 / 2.4.4-p16 — anything below your branch's level is exposed. Full SessionReaper guide →
CosmicSting — CVE-2024-34102
An XXE bug (APSB24-40, CVSS 9.8) that leaks your encryption key, chainable to RCE and admin-JWT forgery. Fixed at 2.4.7-p1 / 2.4.6-p6 / 2.4.5-p8 / 2.4.4-p9. Patching isn't enough — you must also rotate the key. Full CosmicSting guide →
TrojanOrders — CVE-2022-24086
Improper input validation in checkout enabling unauthenticated RCE via crafted order/email-template payloads. Old but still hitting unpatched/EOL stores. Fixed at 2.4.3-p2 / 2.3.7-p3 — if you're on 2.4.4+ you're patched against it.
How to check your store
Three steps: (1) find your version with bin/magento --version; (2) compare to the fixed levels above for your branch; (3) apply the highest applicable patch. MageArgus does this automatically and also checks for skimmers, exposed files and a discoverable admin. See how to apply the patch.
Frequently asked questions
How do I know which CVEs affect my store?
It depends on your exact patch level. Run a scan (or bin/magento --version) and compare to each CVE's fixed version for your branch — MageArgus reports this per-CVE with AT RISK / PATCHED status.
I'm on the latest patch — am I safe from these?
From these specific CVEs, yes. But new bulletins ship quarterly, so keep patching and scanning regularly.