Scworld

Critical PHP Object Injection Vulnerability in Mirasvit Cache Warmer

First seen 4 Jun 2026, 21:12 UTC • Scworld

+3 •72.9

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

A critical vulnerability, CVE-2026-45247, has been identified in the Mirasvit Full Page Cache Warmer for Magento 2, allowing unauthenticated remote code execution via a crafted CacheWarmer cookie. The flaw, rated 9.8 on the CVSS scale, affects versions prior to 1.11.12 and is due to unsafe deserialization of attacker-controlled data. Mirasvit released a patch on May 25, 2026, and users are urged to update immediately as the vulnerability is actively exploited. Security teams are advised to monitor for exploitation attempts, which can be identified by specific request signatures. The vulnerability highlights the importance of patch management and proactive security measures in e-commerce environments.

Key Points: • CVE-2026-45247 allows unauthenticated remote code execution via a crafted cookie. • The vulnerability affects Mirasvit Full Page Cache Warmer for Magento 2 versions before 1.11.12. • Mirasvit released a patch on May 25, 2026, and users are urged to update immediately.

Ask AI about this cluster

Answers cite the sources they use

How this analysis works

Timeline

2026-05-26

CVE-2026-45247 published

Mirasvit disclosed a critical PHP object injection vulnerability affecting their Cache Warmer extension.

nvd.nist.gov

2026-06-03

CVE added to CISA KEV

CVE-2026-45247 was added to the Known Exploited Vulnerabilities Catalog due to active exploitation.

Darknetsearch

2026-06-04

First public PoC released

A proof of concept for exploiting CVE-2026-45247 was made public, increasing the risk of attacks.

sansec.io

2026-06-05

Security update recommended

Mirasvit urged all users to update to version 1.11.12 to mitigate the critical vulnerability.

Csa.Sg

Attack Flow

19 entities, 52 inferred relationships (STIX 2.1).

Technique (8)

Data Breach
Malware
Ransomware
Remote Code Execution
Zero-day Exploit
T1059.004 - Unix Shell
T1190 - Exploit Public-Facing Application
T1203 - Exploitation for Client Execution

Organization (1)

Cloudflare

Vulnerability (3)

CVE-2026-45247
Mirasvit Full Page Cache Warmer Extension Flaw
PHP Object Injection

Weakness (1)

Cwe-502 - Deserialization Of Untrusted Data

Affected Platform (4)

Adobe Commerce
Magento
Magento 2
PHP

Tool (2)

Python Pickle Library
Python Subprocess Module

Relationships

Python Pickle Library exploits CVE-2026-45247
Python Pickle Library exploits Mirasvit Full Page Cache Warmer Extension Flaw
Python Pickle Library exploits PHP Object Injection
Python Subprocess Module exploits CVE-2026-45247
Python Subprocess Module exploits Mirasvit Full Page Cache Warmer Extension Flaw
Python Subprocess Module exploits PHP Object Injection
CVE-2026-45247 targets Adobe Commerce
CVE-2026-45247 targets Magento
CVE-2026-45247 targets Magento 2
CVE-2026-45247 targets PHP
Mirasvit Full Page Cache Warmer Extension Flaw targets Adobe Commerce
Mirasvit Full Page Cache Warmer Extension Flaw targets Magento
Mirasvit Full Page Cache Warmer Extension Flaw targets Magento 2
Mirasvit Full Page Cache Warmer Extension Flaw targets PHP
PHP Object Injection targets Adobe Commerce
PHP Object Injection targets Magento
PHP Object Injection targets Magento 2
PHP Object Injection targets PHP
Data Breach targets Adobe Commerce
Data Breach targets Magento
Data Breach targets Magento 2
Data Breach targets PHP
Malware targets Adobe Commerce
Malware targets Magento
Malware targets Magento 2
Malware targets PHP
Ransomware targets Adobe Commerce
Ransomware targets Magento
Ransomware targets Magento 2
Ransomware targets PHP
Remote Code Execution targets Adobe Commerce
Remote Code Execution targets Magento
Remote Code Execution targets Magento 2
Remote Code Execution targets PHP
Zero-day Exploit targets Adobe Commerce
Zero-day Exploit targets Magento
Zero-day Exploit targets Magento 2
Zero-day Exploit targets PHP
T1059.004 - Unix Shell targets Adobe Commerce
T1059.004 - Unix Shell targets Magento
T1059.004 - Unix Shell targets Magento 2
T1059.004 - Unix Shell targets PHP
T1190 - Exploit Public-Facing Application targets Adobe Commerce
T1190 - Exploit Public-Facing Application targets Magento
T1190 - Exploit Public-Facing Application targets Magento 2
T1190 - Exploit Public-Facing Application targets PHP
T1203 - Exploitation for Client Execution targets Adobe Commerce
T1203 - Exploitation for Client Execution targets Magento
T1203 - Exploitation for Client Execution targets Magento 2
T1203 - Exploitation for Client Execution targets PHP
CVE-2026-45247 related to Cloudflare
CVE-2026-45247 related to Cwe-502 - Deserialization Of Untrusted Data

Continue Reading

Russian Hackers Exploit Zimbra Zero-Day for Espionage Campaign Gamaredon Exploits WinRAR Vulnerability in Ongoing Ukraine Campaign Mirage Kitten Targets Aviation and FinTech with New Cross-Platform Malware Ghost CMS SQL Injection Exploits 700+ Sites in Ongoing ClickFix Campaign Gamaredon APT Escalates Cyber Operations Against Ukraine in 2025 MuddyWater Targets U.S. Entities Amid Geopolitical Tensions

Critical PHP Object Injection Vulnerability in Mirasvit Cache Warmer

Article Content

Timeline

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading