Security AffairsPierluigi Paganini
CISA adds Magento cache flaw CVE-2026-45247 to KEV catalogue
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the Mirasvit Full Page Cache Warmer flaw (CVE-2026-45247) to its Known Exploited Vulnerabilities catalog. This critical PHP object injection vulnerability impacts Mirasvit versions below 1.11.12 for Magento 2, allowing unauthenticated attackers to achieve remote code execution by exploiting an unsafe `unserialize()` call.
Researchers from Sansec discovered that a single specially crafted cookie can trigger remote code execution, with thousands of Magento stores potentially affected. CISA mandates that federal agencies rectify this flaw by June 6, 2026, and advises private organizations to review and address related vulnerabilities.
Story timeline CVE-2026-45247
Full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Wed 3 Jun · 20:51 UTC | CISA | CISA warns of exploits in Magento cache extension CVE-2026-45247 |
| Thu 4 Jun · 02:11 UTC | CISA | CISA flags Mirasvit cache flaw CVE-2026-45247 as exploited. |
| Thu 4 Jun · 08:50 UTC | The Hacker News | CISA urges patching of exploited Magento RCE flaw CVE-2026-45247 |
| Thu 4 Jun · 12:48 UTC | SecurityWeek | CISA warns federal agencies to patch critical Magento cache flaw |
| Thu 4 Jun · 17:50 UTC | Security Affairs | CISA adds Magento cache flaw CVE-2026-45247 to KEV catalogue (this article) |