Critical severity · published May 26, 2026
CVE-2026-45247
Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection
In wildKEV
9.8
CVSS
26.2%
EPSS
Yes
On KEV
Description
Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Attackers can exploit the unrestricted call to PHP's native unserialize() function combined with gadget chains available in Magento and its dependencies to execute arbitrary code on the server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)26.2% · higher than 98% of CVEs
Exploited in the wildYes
CISA KEVListed Jun 3, 2026
Federal remediation dueJun 6, 2026
Ransomware campaign useNot known
Affected products
Which versions
FP
Full Page Cache Warmer for Magento 2 · Mirasvit
before 1.11.12 · source: vendor
FP
Full Page Cache Warmer · Mirasvit
before 1.11.12 · source: NVD
MF
Mirasvit Full Page Cache Warmer · Mirasvit
All versions, or not specified · source: KEV
In the news
VulnerabilityCritical
U.S. CISA adds Mirasvit Full Page Cache Warmer flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Mirasvit Full Page Cache Warmer flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Mirasvit Full Page Cache Warmer flaw, tracked as CVE-2026-45247 (CVSS ver 4.0 score of 9.3), to its Known Exploited Vulnerabilities (KEV) catalog. The CVE-2026-45247 flaw is a […]
Jun 4, 2026·Security Affairs
VulnerabilityCritical
CISA Adds Exploited Magento RCE Flaw CVE-2026-45247 to KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical flaw impacting Mirasvit Cache Warmer, a popular Magento full-page cache extension, to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation in the wild.
The vulnerability, tracked as CVE-2026-45247 (CVSS score: 9.8), is a case of deserialization of untrusted
Jun 4, 2026·The Hacker News
VulnerabilityHigh
[CISA KEV] CVE-2026-45247: Mirasvit Mirasvit Full Page Cache Warmer - Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability
Mirasvit Full Page Cache Warmer contains a deserialization of untrusted data vulnerability that could allow unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie.
MFMirasvit Full Page Cache WarmerCVE-2026-45247
Jun 3, 2026·CISA KEV
Affected product
FP
Full Page Cache Warmer for Magento 2
Mirasvit
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-45247
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-45247
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
technical-description
https://sansec.io/research/mirasvit-cache-warmer-object-injection
release-notes
https://mirasvit.com/package/changelog/?package=mirasvit/module-cache-warmer
third-party-advisory
https://www.vulncheck.com/advisories/mirasvit-cache-warmer-for-magento-php-object-injection