Vulnerability record · CVE-2026-45247 · published 26 May 2026
CVE-2026-45247: Mirasvit Full Page Cache Warmer for Magento 2 PHP object injection RCE
Mirasvit · Full Page Cache Warmer
Mirasvit Full Page Cache Warmer for Magento 2 before 1.11.12 passes the CacheWarmer cookie to PHP's native unserialize() without restriction, allowing PHP object injection. Because Magento and its dependencies ship usable gadget chains, a crafted serialized object can lead to remote code execution on the server.
Description
Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Attackers can exploit the unrestricted call to PHP's native unserialize() function combined with gadget chains available in Magento and its dependencies to execute arbitrary code on the server.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:
Automated analysis
critical priorityUnauthenticated network-reachable RCE with a CVSS 4.0 score of 9.3 and confirmed exploitation in CISA KEV.
What it is
Mirasvit Full Page Cache Warmer for Magento 2 before 1.11.12 passes the CacheWarmer cookie to PHP's native unserialize() without restriction, allowing PHP object injection. Because Magento and its dependencies ship usable gadget chains, a crafted serialized object can lead to remote code execution on the server.
Impact
An unauthenticated attacker can execute arbitrary code on the Magento server, giving full control of the application and its data.
Attack surface
Reachable over the network via the CacheWarmer cookie on the affected Magento 2 storefront; no authentication or user interaction is required per the CVSS vector (AV:N/PR:N/UI:N).
Exploitation
Listed in CISA KEV with a 2026-06-03 addition and 2026-06-06 remediation due date, and EPSS 30-day probability of 0.27546 (97.9th percentile), indicating active exploitation. No ransomware campaign use is documented.
What to do
- Upgrade Mirasvit Full Page Cache Warmer to version 1.11.12 or later.
- If patching is not immediately possible, disable or remove the extension, or block requests carrying the CacheWarmer cookie at the WAF/reverse proxy.
- Follow CISA KEV required action and BOD 22-01 guidance for cloud-hosted Magento instances.
- Review Magento and dependency gadget chains and restrict unserialize() usage in custom modules.
- Rotate secrets and credentials and audit the server for webshells if compromise is suspected.
Detection
- Inspect web server and WAF logs for requests containing a CacheWarmer cookie, especially with serialized PHP object payloads (O: or a: patterns).
- Monitor for unexpected outbound connections, new PHP files, or process execution from the Magento web root.
- Alert on PHP errors or warnings referencing unserialize() in cache warmer code paths.
- Hunt for anomalous admin or file-system activity following requests with the CacheWarmer cookie.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2026-45247 to the Known Exploited Vulnerabilities catalog on 3 June 2026 as "Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability". Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 6 June 2026.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://mirasvit.com/package/changelog/?package=mirasvit/module-cache-warmer | Release Notes |
| https://sansec.io/research/mirasvit-cache-warmer-object-injection | Third Party Advisory |
| https://www.vulncheck.com/advisories/mirasvit-cache-warmer-for-magento-php-object-injection | Third Party Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45247 | US Government Resource |
| https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-45247-in-mirasvit-full-page-cache-warmer-for-m | Third Party Advisory |
Track CVE-2026-45247 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2026-45247), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
