In CISA KEV9.8 CriticalCWE-502
CVE-2026-45247
Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability
MirasvitMirasvit Full Page Cache Warmer
Status
- Exploited in the wild
- In CISA KEV since 3 Jun
- Fixed in version 1.11.12
Federal deadlineSat 6 Jun, 23:59 UTC
Passed 140 days ago
CISA KEV · added 3 Jun
Exploit probabilityEPSSchecked 24 Oct
2.1%probability of exploitation in the next 30 days
Higher than 81% of scored CVEs
SeverityCVSS
9.8Critical
Description NVD
Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Attackers can exploit the unrestricted call to PHP's native unserialize() function combined with gadget chains available in Magento and its dependencies to execute arbitrary code on the server.
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage 5 articles · 4 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Wed 3 Jun · 20:51 UTC | CISA | CISA warns of exploits in Magento cache extension CVE-2026-45247 |
| Thu 4 Jun · 02:11 UTC | CISA | CISA flags Mirasvit cache flaw CVE-2026-45247 as exploited. |
| Thu 4 Jun · 08:50 UTC | The Hacker News | CISA urges patching of exploited Magento RCE flaw CVE-2026-45247 |
| Thu 4 Jun · 12:48 UTC | SecurityWeek | CISA warns federal agencies to patch critical Magento cache flaw |
| Thu 4 Jun · 17:50 UTC | Security Affairs | CISA adds Magento cache flaw CVE-2026-45247 to KEV catalogue |
- CISA adds Magento cache flaw CVE-2026-45247 to KEV catalogueSecurity Affairs
- CISA warns federal agencies to patch critical Magento cache flawSecurityWeek
- CISA urges patching of exploited Magento RCE flaw CVE-2026-45247The Hacker News
- CISA flags Mirasvit cache flaw CVE-2026-45247 as exploited.CISA · official notice
- CISA warns of exploits in Magento cache extension CVE-2026-45247CISA · first in our coverage · official notice