Which versions of Mirasvit Cache Warmer are affected by CVE-2026-45247?

Mirasvit Full Page Cache Warmer for Magento 2 (versions before 1.11.12) contains a critical unauthenticated remote code execution vulnerability confirmed actively exploited (CISA KEV).. A patch is available.

Is there a public PoC exploit available for CVE-2026-45247?

Yes, a public proof-of-concept exploit is available for CVE-2026-45247. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-45247?

24 hours: Audit all Magento 2 deployments to identify instances running Mirasvit Full Page Cache Warmer and document current versions. 7 days: Patch all affected instances to version 1.11.12 or later. 30 days: Conduct post-patch verification and review access logs for indicators of exploitation.

Mirasvit Cache Warmer CVE-2026-45247

Q: What is the CVSS score of CVE-2026-45247?

CVE-2026-45247 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-31837 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-05-26 VulnCheck

GHSA-rg8p-9rpg-r32p

PHP Adobe Deserialization RCE Full Page Cache Warmer For Magento 2

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 08:37 vuln.today

Added to CISA KEV

Jun 03, 2026 - 17:31 CISA

CVSS changed

May 26, 2026 - 15:22 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

CVE Published

May 26, 2026 - 14:15 nvd

CRITICAL 9.3

DescriptionCVE.org

Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Attackers can exploit the unrestricted call to PHP's native unserialize() function combined with gadget chains available in Magento and its dependencies to execute arbitrary code on the server.

AnalysisAI

Remote code execution in Mirasvit Full Page Cache Warmer for Magento 2 before 1.11.12 allows unauthenticated attackers to execute arbitrary code by sending a crafted serialized PHP object in the CacheWarmer cookie. The flaw is confirmed actively exploited (CISA KEV) with publicly available exploit code, and successful exploitation chains Magento and dependency gadget chains via an unsafe call to unserialize(). Despite a low EPSS score (0.10%), KEV listing and CVSS 9.3 indicate this is a high-priority patch for any Magento 2 store running the module.

Technical ContextAI

The vulnerability is a classic CWE-502 (Deserialization of Untrusted Data) issue rooted in PHP's native unserialize() function being invoked on attacker-controlled input read from the CacheWarmer HTTP cookie. PHP object injection becomes RCE when reachable gadget chains exist in loaded classes; Magento 2 and its broader Composer dependency tree (Symfony, Zend/Laminas, Guzzle, Monolog) historically expose POP gadgets that can pivot deserialization into arbitrary file writes or command execution. The affected component is identified by CPE cpe:2.3:a:mirasvit:full_page_cache_warmer_for_magento_2:*, a third-party module that pre-warms Magento full-page caches and processes the cookie before any authentication layer, making the sink reachable from the unauthenticated edge.

RemediationAI

Upgrade the Mirasvit Full Page Cache Warmer module to vendor-released patch version 1.11.12 or later via Composer (composer update mirasvit/module-cache-warmer), then run setup:upgrade and clear caches; the vendor changelog at https://mirasvit.com/package/changelog/?package=mirasvit/module-cache-warmer documents the fix. If immediate upgrade is not feasible, deploy a WAF or reverse-proxy rule to strip or block requests carrying the CacheWarmer cookie at the edge (Imperva has published protection guidance at https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-45247-in-mirasvit-full-page-cache-warmer-for-magento/), with the trade-off that cache pre-warming functionality will be disabled for legitimate triggers until restored. As a temporary stopgap, disabling the Mirasvit Cache Warmer module entirely (bin/magento module:disable Mirasvit_CacheWarmer) removes the sink at the cost of losing pre-warmed cache performance. Hunt for indicators of compromise given confirmed active exploitation: review web server logs for anomalous CacheWarmer cookie values (long base64/serialized blobs beginning with O: or a:), audit pub/media and var/ for unexpected PHP files, and rotate Magento admin and integration credentials if compromise is suspected.