PT-2026-43258 · Mirasvit · Full Page Cache Warmer

Sansec · Published 2026-05-26 · Updated 2026-06-04 · CVE-2026-45247

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mirasvit Full Page Cache Warmer for Magento 2 versions prior to 1.11.12

Description An issue exists where unauthenticated attackers can achieve remote code execution by providing a crafted serialized PHP object within the CacheWarmer cookie. This is possible due to an unrestricted call to the native PHP unserialize() function, which, when combined with gadget chains in Magento and its dependencies, allows arbitrary code execution on the server. This flaw has been actively exploited in the wild and potentially exposes thousands of Magento shops worldwide.

Recommendations Update to version 1.11.12. Review systems for indicators of compromise (IOCs). Strengthen access controls and administrative account security.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-45247

Affected Products

Full Page Cache Warmer

References · 34

• https://nvd.nist.gov/vuln/detail/CVE-2026-45247 · Security Note
• https://twitter.com/evanderburg/status/2062450627326930982 · Twitter Post
• https://twitter.com/TheHackersNews/status/2062434181326745701 · Twitter Post
• https://twitter.com/molari999/status/2062450845455729099 · Twitter Post
• https://twitter.com/OrizonCyber/status/2059326216377692554 · Twitter Post
• https://reddit.com/r/SecOpsDaily/comments/1twi6eo/cisa_adds_exploited_magento_rce_flaw_cve202645247 · Reddit Post
• https://t.me/defcon_news/136130 · Telegram Post
• https://twitter.com/dailycve/status/2062317875503722618 · Twitter Post
• https://twitter.com/wvipersg/status/2062450373948797260 · Twitter Post
• https://reddit.com/r/cybersecurity/comments/1twgeyd/cisa_adds_exploited_magento_rce_flaw_cve202645247 · Reddit Post
• https://twitter.com/threadlinqs/status/2061589946935202213 · Twitter Post
• https://vulncheck.com/advisories/mirasvit-cache-warmer-for-magento-php-object-injection · Note
• https://twitter.com/TweetThreatNews/status/2062470691983675461 · Twitter Post
• https://twitter.com/JedisecX/status/2062450832201646351 · Twitter Post
• https://twitter.com/shah_sheikh/status/2062450622180593739 · Twitter Post