Critical PHP Object Injection Vulnerability in Mirasvit Cache Warmer

Scworld

Critical PHP Object Injection Vulnerability in Mirasvit Cache Warmer

First seen 4 Jun 2026, 21:12 UTC • •72.9

Article Content

1 / 9

Browse articles

ThreatCluster •June 5, 2026 at 20:56 UTC

•CVE-2026-45247 allows unauthenticated remote code execution via a crafted cookie.
•The vulnerability affects Mirasvit Full Page Cache Warmer for Magento 2 versions before 1.11.12.
•Mirasvit released a patch on May 25, 2026, and users are urged to update immediately.

A critical vulnerability, CVE-2026-45247, has been identified in the Mirasvit Full Page Cache Warmer for Magento 2, allowing unauthenticated remote code execution via a crafted CacheWarmer cookie. The flaw, rated 9.8 on the CVSS scale, affects versions prior to 1.11.12 and is due to unsafe deserialization of attacker-controlled data. Mirasvit released a patch on May 25, 2026, and users are urged to update immediately as the vulnerability is actively exploited. Security teams are advised to monitor for exploitation attempts, which can be identified by specific request signatures. The vulnerability highlights the importance of patch management and proactive security measures in e-commerce environments.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 137d ago How this analysis works

Timeline

2026-05-26

CVE-2026-45247 published

Mirasvit disclosed a critical PHP object injection vulnerability affecting their Cache Warmer extension.

2026-06-03

CVE added to CISA KEV

CVE-2026-45247 was added to the Known Exploited Vulnerabilities Catalog due to active exploitation.

2026-06-04

First public PoC released

A proof of concept for exploiting CVE-2026-45247 was made public, increasing the risk of attacks.

2026-06-05

Security update recommended

Mirasvit urged all users to update to version 1.11.12 to mitigate the critical vulnerability.

More articles in this cluster (8)

Threat Graph

14 entities, 34 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (5)

Data Breach
Ransomware
Remote Code Execution
Zero-day Exploit
T1203 - Exploitation for Client Execution

Organization (1)

Cloudflare

Vulnerability (3)

CVE-2026-45247
Mirasvit Full Page Cache Warmer Extension Flaw
PHP Object Injection

Weakness (1)

CWE-502 - Deserialization Of Untrusted Data

Affected Platform (4)

Adobe Commerce
Magento
Magento 2
PHP

Relationships

CVE-2026-45247 targets Adobe Commerce
CVE-2026-45247 targets Magento
CVE-2026-45247 targets Magento 2
CVE-2026-45247 targets PHP
Mirasvit Full Page Cache Warmer Extension Flaw targets Adobe Commerce
Mirasvit Full Page Cache Warmer Extension Flaw targets Magento
Mirasvit Full Page Cache Warmer Extension Flaw targets Magento 2
Mirasvit Full Page Cache Warmer Extension Flaw targets PHP
PHP Object Injection targets Adobe Commerce
PHP Object Injection targets Magento
PHP Object Injection targets Magento 2
PHP Object Injection targets PHP
Data Breach targets Adobe Commerce
Data Breach targets Magento
Data Breach targets Magento 2
Data Breach targets PHP
Ransomware targets Adobe Commerce
Ransomware targets Magento
Ransomware targets Magento 2
Ransomware targets PHP
Remote Code Execution targets Adobe Commerce
Remote Code Execution targets Magento
Remote Code Execution targets Magento 2
Remote Code Execution targets PHP
Zero-day Exploit targets Adobe Commerce
Zero-day Exploit targets Magento
Zero-day Exploit targets Magento 2
Zero-day Exploit targets PHP
T1203 - Exploitation for Client Execution targets Adobe Commerce
T1203 - Exploitation for Client Execution targets Magento
T1203 - Exploitation for Client Execution targets Magento 2
T1203 - Exploitation for Client Execution targets PHP
CVE-2026-45247 related to Cloudflare
CVE-2026-45247 related to CWE-502 - Deserialization Of Untrusted Data

Following this threat?

Track Cloudflare and CVE-2026-45247 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group A critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS score of 9.3, has been exploited by the China-linked espionage group Armory Castle since August 29, 2026. This flaw allows unauthenticated remote attackers to perform file operations, gaining root control and access to…

Silent Lynx Targets CIS Governments via WinRAR Exploit The threat actor Silent Lynx has launched a series of attacks against government organizations in the Commonwealth of Independent States (CIS) from June 2025 to August 2026. These attacks exploit a vulnerability in WinRAR (CVE-2025-8088) to deploy reverse shells, including FoalShell and PickleShell, facilitating…