CVE-2026-45247

nvd.nist.gov • June 4, 2026

Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Attackers can exploit the unrestricted call to PHP's native unserialize() function combined with gadget chains available in Magento and its dependencies to execute arbitrary code on the server.

Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical PHP Object Injection Vulnerability in Mirasvit Cache Warmer A critical vulnerability, CVE-2026-45247, has been identified in the Mirasvit Full Page Cache Warmer for Magento 2, allowing unauthenticated remote code execution via a crafted CacheWarmer cookie. The flaw, rated 9.8 on the CVSS scale, affects versions prior to 1.11.12 and is due to unsafe deserialization of attacker-controlled data. Mirasvit released a patch on May 25, 2026, and users are urged to update immediately as the vulnerability is actively exploited. Security teams are advised to monitor for exploitation attempts, which can be identified by specific request signatures. The vulnerability highlights the importance of patch management and proactive security measures in e-commerce environments. 8 sources 73

Extracted Entities

CVE-2026-45247

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (1)