CVE-2026-45247
Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability
Description
CVE-2026-45247 is a critical deserialization of untrusted data vulnerability, commonly described as a PHP object injection flaw, affecting the Mirasvit Full Page Cache Warmer for Magento 2. The Mirasvit Full Page Cache Warmer passes the attacker-controlled CacheWarmer cookie to PHP's native unserialize() function without restriction, and when combined with gadget chains available in Magento and its dependencies this enables unauthenticated remote code execution on the server. This matters because CVE-2026-45247 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, carries a CRITICAL CVSS 3.1 base score of 9.8, and has an EPSS score placing it in the 91st percentile of exploitation likelihood. Because the deserialization of untrusted data occurs before authentication, any remote attacker who can reach the affected Magento 2 store can attempt exploitation. Administrators of the Mirasvit Full Page Cache Warmer should treat this as an urgent, actively exploited issue and remediate without delay.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| mirasvit | full page cache warmer | < 1.11.12 |
References
- https://mirasvit.com/package/changelog/?package=mirasvit/module-cache-warmer(Release Notes)
- https://sansec.io/research/mirasvit-cache-warmer-object-injection(Third Party Advisory)
- https://www.vulncheck.com/advisories/mirasvit-cache-warmer-for-magento-php-object-injection(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45247(US Government Resource)
- https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-45247-in-mirasvit-full-page-cache-warmer-for-magento/(Third Party Advisory)
Weakness Type
CWE-502: Deserialization of Untrusted Data
The application calls PHP's native unserialize() function on the attacker-controlled CacheWarmer cookie without verifying that the serialized data is safe, allowing a crafted serialized PHP object to instantiate arbitrary objects. Combined with available gadget chains, this object injection can be leveraged to execute arbitrary code on the server.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
The vulnerability is exploitable over the network (Attack Vector: Network) and requires only low complexity (Attack Complexity: Low), meaning no special conditions must be met. It needs no privileges (Privileges Required: None) and no user interaction (User Interaction: None), so an unauthenticated remote attacker can trigger it directly. The impact remains within the affected component (Scope: Unchanged), but the consequences are severe across all three security objectives: Confidentiality: High, Integrity: High, and Availability: High, because successful remote code execution allows an attacker to read sensitive data, modify application state, and disrupt service, resulting in full system compromise. These metrics produce a CVSS 3.1 base score of 9.8 (CRITICAL). The EPSS score of 0.06149 (90.99th percentile) indicates an elevated likelihood of exploitation in the wild relative to other vulnerabilities.
Exploit Maturity
CISA has confirmed active exploitation by listing CVE-2026-45247 in the Known Exploited Vulnerabilities (KEV) catalog. Detailed public technical analysis and vulnerability research is available from Sansec and VulnCheck describing the object-injection chain, including the Sansec write-up at https://sansec.io/research/mirasvit-cache-warmer-object-injection. The EPSS score of 0.06149 (90.99th percentile) reflects a high relative likelihood of exploitation. There is no known ransomware association, and the available references constitute public research and analysis rather than packaged exploit code.
Remediation
- Follow the CISA KEV required action: "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable."
- Upgrade Mirasvit Full Page Cache Warmer to version 1.11.12 or later, which contains the fix for this vulnerability.
- If you cannot patch immediately, apply interim mitigations: block or strip the CacheWarmer cookie at the WAF or reverse proxy, avoid deserializing untrusted input, restrict access to the module, and deploy WAF rules that detect serialized-object payloads.
- Monitor your environment: inspect web server and application logs for crafted CacheWarmer cookies and for unexpected PHP execution that may indicate exploitation.
- As a long-term measure, prefer signed or integrity-checked data formats, enforce class allowlists during deserialization, and avoid calling unserialize() on untrusted input altogether.
Technical Details
The root cause is an unrestricted call to PHP's native unserialize() function on the CacheWarmer cookie, which lets an attacker supply a crafted serialized PHP object. When this object is combined with gadget chains present in Magento and its dependencies, the deserialization yields arbitrary code execution on the server. Because the cookie is processed before authentication, the attack requires no credentials. The corresponding CVSS vector reflects this exposure: the flaw is reachable over the network with low attack complexity, requires no privileges and no user interaction, and results in full loss of confidentiality, integrity, and availability.
Frequently Asked Questions
Is CVE-2026-45247 being actively exploited?
Yes. CISA has added CVE-2026-45247 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. There is no known ransomware association at this time.
What products are affected by CVE-2026-45247?
The Mirasvit Full Page Cache Warmer module for Magento 2 in versions before 1.11.12 is affected.
How do I fix CVE-2026-45247?
Upgrade the Mirasvit Full Page Cache Warmer to version 1.11.12 or later. If you cannot patch immediately, block or strip the CacheWarmer cookie at the WAF, avoid deserializing untrusted input, and monitor logs for crafted cookies and unexpected PHP execution.
How severe is CVE-2026-45247?
It is rated CRITICAL with a CVSS 3.1 base score of 9.8. It enables unauthenticated remote code execution, leading to full compromise of confidentiality, integrity, and availability, and its EPSS score is in the 90.99th percentile.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.