Free tools Windows power users keep installed
One-click scans. No signup required.
In a report dated January 17, 2023, security firm Sansec said it had observed some agencies and extension vendors restoring Magento’s deprecated email-template variable resolver after Adobe removed it as part of security hardening. The report described a compatibility-driven code risk—not a count of vulnerable stores. Adobe’s related bulletin covers CVE-2022-24086 and CVE-2022-24087 in Adobe Commerce and Magento Open Source.
What Adobe’s Magento security bulletin covered
Adobe published security bulletin APSB22-12 on February 13, 2022, and updated it on February 17, 2022. It covers CVE-2022-24086 and CVE-2022-24087, both classified as critical improper-input-validation vulnerabilities affecting Adobe Commerce and Magento Open Source. Adobe assigned each a CVSS 3.1 score of 9.8 and stated: “Successful exploitation could lead to arbitrary code execution.” Read Adobe’s APSB22-12 bulletin and version-specific guidance.
At the time of the bulletin, Adobe said CVE-2022-24086 had been exploited in “very limited attacks” targeting Adobe Commerce merchants. That statement describes Adobe’s assessment in 2022; it does not establish current exploitation activity.
What Sansec said vendors were restoring
Sansec’s January 17, 2023 observation, reported by SecurityWeek on January 18, described attempts to bring back behavior associated with Magento’s deprecated LegacyResolver after Adobe’s security change introduced StrictResolver and removed smart mail templates. Sansec described two patterns:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →#1 Best Overall
- Overriding StrictResolver behavior to restore LegacyResolver behavior.
- Copying older LegacyResolver code and using it as a preference for VariableResolverInterface.
Sansec said the apparent motivation in some cases was compatibility: avoiding the work of updating existing email templates to work with StrictResolver. This is evidence of observed implementation patterns, not proof that every vendor or agency took that approach. Read Sansec’s account of the resolver bypasses; SecurityWeek’s January 18, 2023 report.
Why restoring the old resolver can matter
The security concern is that restoring deprecated template-variable behavior can undermine the hardening intended to prevent unsafe input from reaching email-template processing. The compatibility benefit—keeping older templates working without updating them—can therefore reintroduce code risk.
Sansec also discussed filtering unsafe user input in the order system, but said basic order-input filtering is not a reliable safeguard: other subsystems that touch email may still trigger the vulnerable behavior. Filtering one input path does not establish that all relevant paths are safe.
| Resolver | Security and compatibility implications described in the sources |
|---|---|
| LegacyResolver | Deprecated behavior; restoring it may preserve older email-template compatibility, but can undo security hardening. |
| StrictResolver | Introduced as part of Adobe’s security change; existing templates may need adjustment to work with it. |
The sources do not provide a complete version-by-version migration table. Use Adobe’s applicable bulletin and patch guidance for the specific installed version rather than assuming a universal patch sequence.
How to assess a Magento store
A store’s exposure cannot be determined from the 2023 report alone. It depends on the installed Adobe Commerce or Magento Open Source version, the fixes applied, and whether custom or vendor code reintroduces the deprecated resolver behavior. A patch indicator is useful, but it is not a substitute for reviewing relevant code and dependencies.
- Confirm the exact product and version in use, then consult Adobe’s bulletin for guidance that applies to that version.
- Review customizations, extensions, and vendor code for StrictResolver overrides or copied LegacyResolver code used with VariableResolverInterface.
- Check email-template compatibility changes and inspect email-touching subsystems beyond order input handling.
- Have a Magento-qualified security professional review uncertain customizations before removing or changing resolver code.
Do not infer that a store is vulnerable merely because it uses Magento, or that it is safe merely because a patch appears to be present. The available reporting does not establish how common resolver bypasses were across stores, and it does not show whether any particular store remains exposed in October 2026.
Quick Recap
Best Value
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
