Critical· 9.3actively exploitedofficial fix available

CVE-2026-45247

Mirasvit Full Page Cache Warmer for Magento 2 contains a critical flaw that lets attackers run arbitrary code on the server by sending a specially crafted cookie. The vulnerability is caused by PHP object injection via the CacheWarmer cookie’s unserialize() call. It affects all versions before 1.11.12.

publishedMay 26, 2026

last modifiedJul 24, 2026

sourcesNVD · CISA-KEV

severity · cvss

9.3

critical · how bad it is

exploitation · epss

28%

98th percentile · chance of exploitation in 30 days

(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →

auto-deletes from the system

counting…on Aug 23, 2026

An official fix is available, so this entry is kept for 30 days and then removed automatically.

Who is affected

Mirasvit Full Page Cache Warmer for Magento 2, versions prior to 1.11.12, used on Magento 2 sites.

Real-world impact

An attacker can execute any code on the web server, potentially taking full control of the site, stealing data, or installing malware.

Why this severity

The CVSS score of 9.3 reflects that the flaw is exploitable over the network with low attack complexity, no user interaction, and it gives attackers full control over confidentiality, integrity, and availability of the affected system.

What to do about it

official fix available

recommended steps

01Upgrade Mirasvit Full Page Cache Warmer to version 1.11.12 or later.

interim mitigations

›Follow vendor instructions for mitigations, apply BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA KEV required action

Timeline

May 26, 2026 · May 26, 2026
Published
Disclosed and added to the National Vulnerability Database.
Jun 3, 2026 · Jun 3, 2026
Confirmed exploited (CISA KEV)
CISA added it to the Known Exploited Vulnerabilities catalog — attackers are using it in the wild.
Jun 6, 2026 · Jun 6, 2026
CISA remediation deadline
Federal agencies are required to remediate by this date.
Jul 24, 2026 · 11d ago
Advisory updated
The NVD record was last revised.
Jul 24, 2026 · 11d ago
Official fix available
A vendor patch or mitigation now exists — see the remediation steps above.

How it’s attacked

Attack vectorNetwork (remote)

Attack complexityLow

Attack requirementsNone

Privileges requiredNone

User interactionNone needed

Confidentiality impactHigh

Integrity impactHigh

Availability impactHigh

References & advisories

mirasvit.com/package/changelog/release notes
sansec.io/research/mirasvit-cache-war…third party advisory
vulncheck.com/advisories/mirasvit-cache-w…third party advisory
cisa.gov/known-exploited-vulnerabili…us government resource
imperva.com/blog/imperva-customers-prot…third party advisory

NVD advisory ↗CISA KEV catalog ↗Search advisories ↗

(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →