Sansec (Magento / e-commerce security)published May 26, 14:39 UTC (May 26, 2026)ingested Sep 10, 06:11 UTCSansec Forensics Team

Critical vulnerability in Mirasvit Cache Warmer for Magento

criticalVulnerability exploited in the wildimportance 60CVE-2026-45247

Read the original

Tagscve-2026-45247 vulnerability

Vulnerabilities mentionedAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-45247	Unauthenticated Deserialization RCE in Mirasvit Full Page Cache Warmer Mirasvit Full Page Cache Warmer, a storefront performance extension for Magento, contains a PHP deserialization flaw (CWE-502) that permits unauthenticated remote code execution. The flaw is triggered simply by sending the store a request carrying a crafted serialized PHP object in the 'CacheWarmer' cookie; when the application unserializes that untrusted value, attacker-controlled object injection executes code in the context of the web server. Successful exploitation yields arbitrary code execution on the storefront host, useful for webshell deployment, data theft, or lateral movement, and it requires no credentials or special privileges. Any site running the extension is affected; no public proof-of-concept is known, but CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-06-03, confirming exploitation in the wild (ransomware use unknown), and EPSS assigns a 27.5% 30-day exploitation probability (98th percentile). Do: Apply Mirasvit's remediation guidance and upgrade the Full Page Cache Warmer extension as soon as the vendor publishes a fixed release; the KEV listing (2026-06-03) makes patching or mitigation mandatory for U.S. federal agencies under BOD 22-01. Until patched, hunt for exploitation by reviewing web access logs for anomalous or oversized 'CacheWarmer' cookie values containing serialized PHP objects (e.g., 'O:'-prefixed payloads) and for indicators of post-exploitation on Magento web servers. If no fix is available yet and the store is internet-facing, consider temporarily disabling the extension or restricting the CacheWarmer cookie handling as an interim mitigation.	9.3	28%	KEV	Mirasvit Full Page Cache Warmer	moderatelikely thousands to tens of thousands of Magento storefronts (commercial extension; exact install counts not published)	May 26, 2026

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-45247

Unauthenticated Deserialization RCE in Mirasvit Full Page Cache Warmer

Mirasvit Full Page Cache Warmer, a storefront performance extension for Magento, contains a PHP deserialization flaw (CWE-502) that permits unauthenticated remote code execution. The flaw is triggered simply by sending the store a request carrying a crafted serialized PHP object in the 'CacheWarmer' cookie; when the application unserializes that untrusted value, attacker-controlled object injection executes code in the context of the web server. Successful exploitation yields arbitrary code execution on the storefront host, useful for webshell deployment, data theft, or lateral movement, and it requires no credentials or special privileges. Any site running the extension is affected; no public proof-of-concept is known, but CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-06-03, confirming exploitation in the wild (ransomware use unknown), and EPSS assigns a 27.5% 30-day exploitation probability (98th percentile).

Do: Apply Mirasvit's remediation guidance and upgrade the Full Page Cache Warmer extension as soon as the vendor publishes a fixed release; the KEV listing (2026-06-03) makes patching or mitigation mandatory for U.S. federal agencies under BOD 22-01. Until patched, hunt for exploitation by reviewing web access logs for anomalous or oversized 'CacheWarmer' cookie values containing serialized PHP objects (e.g., 'O:'-prefixed payloads) and for indicators of post-exploitation on Magento web servers. If no fix is available yet and the store is internet-facing, consider temporarily disabling the extension or restricting the CacheWarmer cookie handling as an interim mitigation.

9.3

28%

KEV

Mirasvit Full Page Cache Warmer

moderatelikely thousands to tens of thousands of Magento storefronts (commercial extension; exact install counts not published)

May 26, 2026

Full article551 words · extracted from sansec.io · click to collapse

Sansec discovered an unauthenticated PHP object injection vulnerability in Mirasvit Cache Warmer, a full-page cache extension for Magento and Adobe Commerce. Any storefront request carrying a crafted CacheWarmer cookie reaches PHP's native unserialize() on attacker-controlled data, with no authentication, no admin session and no config toggle required. With a suitable gadget chain, this leads to remote code execution.

The flaw is tracked as CVE-2026-45247, rated 9.8 (critical). Mirasvit released a patched version (1.11.12) on May 25, 2026 and is asking all customers to update.

Sansec Shield customers were protected on April 24, 2026, the day we found the flaw.

How the attack works

Mirasvit Cache Warmer pre-populates Magento's full-page cache for every "vary" state of a page (currency, customer group, and so on). To render a page as a specific visitor, the warmer packs the target session state into a cookie and sends it with each crawl request. On the server, a plugin reads that cookie and switches currency and customer session to match before rendering.

The plugin runs on every storefront request, not just on warmer traffic.

The extension deserializes part of the cookie value with PHP's native unserialize(), without restricting which classes may be instantiated. Because that value comes straight from the client, an attacker controls the objects PHP reconstructs. This is PHP object injection (CWE-502). Combined with a gadget chain from classes that Magento and its dependencies already ship, object injection escalates to remote code execution.

Who is affected

All Mirasvit Cache Warmer versions before 1.11.12 are vulnerable. The extension is bundled with several Mirasvit packages, so many merchants run it without having installed it directly.

Sansec scans found roughly 6,000 stores running Mirasvit extensions. Real numbers are likely higher, since content delivery networks such as Cloudflare hide many installs from our fingerprinting.

Detection

The attack leaves a clear request signature. Look for storefront requests that carry a CacheWarmer cookie whose value contains the marker CacheWarmer: followed by a base64 string. Serialized PHP objects base64-encode to values starting with Tz, Qz or YT, so a CacheWarmer cookie value matching CacheWarmer:(Tz|Qz|YT) is a strong indicator of an exploitation attempt.

Recommendations

Update now: Upgrade Mirasvit Cache Warmer to 1.11.12 or later. See the Mirasvit changelog.
Block attacks: Deploy Sansec Shield to block exploitation attempts in real time, including on stores that cannot patch immediately.
Scan for compromise: Run eComscan to detect webshells, backdoors and other malware that an attacker may have planted.
Check web-accessible directories: Review pub/ and other web-reachable folders for unexpected PHP files.

Timeline

Date	Event
April 24, 2026	Sansec discovers the vulnerability
April 24, 2026	Sansec Shield rule deployed
May 21, 2026	Mirasvit notified
May 25, 2026	Mirasvit releases patched version 1.11.12
May 26, 2026	CVE-2026-45247 assigned (9.8 critical)
May 26, 2026	This advisory published

Mirasvit responded fast, shipping a fix within days of our report. Merchants should update without delay: the flaw needs no authentication, fires on ordinary storefront traffic, and the request signature is trivial for attackers to automate once the patch reveals the fix.

Text extracted automatically; images, tables and formatting may be missing. Original: https://sansec.io/research/mirasvit-cache-warmer-object-injection