Vulnerabilities / CVE-2026-45247

CVE-2026-45247

Published 2026-05-26 · published (not yet in NVD)

CVE-2026-45247

Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection

Exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-06-03, with a fix-by date of 2026-06-06. Patch it first.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

9.3 CRITICAL
CVSS 4.0 · CNA

26%
chance of exploitation in the next 30 days (EPSS; higher than 97% of CVEs)

Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Attackers can exploit the unrestricted call to PHP's native unserialize() function combined with gadget chains available in Magento and its dependencies to execute arbitrary code on the server.

Scores

9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NCNA

9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCNA

Affected products

Mirasvit Full Page Cache Warmer for Magento 2: < 1.11.12

Weakness: CWE-502

3 references (advisories, patches, write-ups)

https://sansec.io/research/mirasvit-cache-warmer-object-injection · technical-description
https://mirasvit.com/package/changelog/?package=mirasvit/module-cache-warmer · release-notes, patch
https://www.vulncheck.com/advisories/mirasvit-cache-warmer-for-magento-php-object-injection · third-party-advisory

Sources: CVE.org, FIRST EPSS. Missing ones did not answer or have no record yet.

Look up another CVE Check your dependencies Scan a website