U.S. CISA adds Mirasvit Full Page Cache Warmer flaw to its Known Exploited Vulnerabilities catalog
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-45247 | Unauthenticated Deserialization RCE in Mirasvit Full Page Cache Warmer Mirasvit Full Page Cache Warmer, a storefront performance extension for Magento, contains a PHP deserialization flaw (CWE-502) that permits unauthenticated remote code execution. The flaw is triggered simply by sending the store a request carrying a crafted serialized PHP object in the 'CacheWarmer' cookie; when the application unserializes that untrusted value, attacker-controlled object injection executes code in the context of the web server. Successful exploitation yields arbitrary code execution on the storefront host, useful for webshell deployment, data theft, or lateral movement, and it requires no credentials or special privileges. Any site running the extension is affected; no public proof-of-concept is known, but CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-06-03, confirming exploitation in the wild (ransomware use unknown), and EPSS assigns a 27.5% 30-day exploitation probability (98th percentile). Do: Apply Mirasvit's remediation guidance and upgrade the Full Page Cache Warmer extension as soon as the vendor publishes a fixed release; the KEV listing (2026-06-03) makes patching or mitigation mandatory for U.S. federal agencies under BOD 22-01. Until patched, hunt for exploitation by reviewing web access logs for anomalous or oversized 'CacheWarmer' cookie values containing serialized PHP objects (e.g., 'O:'-prefixed payloads) and for indicators of post-exploitation on Magento web servers. If no fix is available yet and the store is internet-facing, consider temporarily disabling the extension or restricting the CacheWarmer cookie handling as an interim mitigation. | 9.3 | 28% | KEV |
| moderatelikely thousands to tens of thousands of Magento storefronts (commercial extension; exact install counts not published) |
Full article471 words · extracted from securityaffairs.com · click to collapse
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Mirasvit Full Page Cache Warmer flaw to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Mirasvit Full Page Cache Warmer flaw, tracked as CVE-2026-45247 (CVSS ver 4.0 score of 9.3), to its Known Exploited Vulnerabilities (KEV) catalog.
The CVE-2026-45247 flaw is a critical PHP object injection vulnerability affecting Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12. The issue allows unauthenticated attackers to send a specially crafted serialized PHP object through the CacheWarmer cookie, which is processed by an unsafe call to PHP’s unserialize() function.
By leveraging gadget chains present in Magento and its dependencies, attackers can achieve remote code execution, potentially gaining full control of the affected server.
“Mirasvit Full Page Cache Warmer contains a deserialization of untrusted data vulnerability that could allow unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie,” CISA reports.
Sansec researchers found the flaw in Mirasvit Cache Warmer, which is a popular Magento full-page cache extension. The experts pointed out that a single crafted cookie on any storefront page can lead to remote code execution.
“Sansec discovered an unauthenticated PHP object injection vulnerability in Mirasvit Cache Warmer, a full-page cache extension for Magento and Adobe Commerce. Any storefront request carrying a crafted CacheWarmer cookie reaches PHP’s native unserialize() on attacker-controlled data, with no authentication, no admin session and no config toggle required. With a suitable gadget chain, this leads to remote code execution.” states Sansec.
The vulnerable component processes a client-controlled CacheWarmer cookie using PHP’s unsafe unserialize() function, allowing attackers to inject malicious objects and exploit gadget chains already present in Magento and its dependencies. The plugin runs on every storefront request, expanding the attack surface. Researchers estimate that thousands of Magento stores may be affected. Sansec warns that exploitation attempts can be identified by suspicious CacheWarmer cookie values containing base64-encoded serialized PHP objects.
“The attack leaves a clear request signature. Look for storefront requests that carry a CacheWarmer cookie whose value contains the marker CacheWarmer: followed by a base64 string. Serialized PHP objects base64-encode to values starting with Tz, Qz or YT, so a CacheWarmer cookie value matching CacheWarmer:(Tz|Qz|YT) is a strong indicator of an exploitation attempt.” concludes Sansec.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the vulnerability by June 6, 2026.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/193156/security/u-s-cisa-adds-mirasvit-full-page-cache-warmer-flaw-to-its-known-exploited-vulnerabilities-catalog.html