PHP Object Injection Vulnerability in Mirasvit Full Page Cache Warmer for Magento 2
CVE-2026-45247
Key Information:
- Vendor
Mirasvit
- Vendor
- CVE Published:
- 26 May 2026
Badges
What is CVE-2026-45247?
false
CISA has reported CVE-2026-45247
CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-45247 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace
The CISA's recommendation is: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
Full Page Cache Warmer for Magento 2 0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
News Articles
It Security NewsCVE-2026-45247CISA Warns of critical Magento Cache Warmer RCE flaw Exploited in Attacks - IT Security News
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning about a critical remote code execution vulnerability affecting the Mirasvit Full Page Cache Warmer extension for Magento, tracked as CVE-2026-45247. The flaw, stemming from insecure deserialization of…Read ...
3 weeks ago
It Security NewsCVE-2026-45247U.S. CISA adds Mirasvit Full Page Cache Warmer flaw to its Known Exploited Vulnerabilities catalog - IT Security News
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Mirasvit Full Page Cache Warmer flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Mirasvit Full Page Cache Warmer flaw, tracked as CVE-2026-45247 (CVSS ver 4.0…...
3 weeks ago
It Security NewsCVE-2026-45247CISA Adds Exploited Magento RCE Flaw CVE-2026-45247 to KEV Catalog - IT Security News
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical flaw impacting Mirasvit Cache Warmer, a popular Magento full-page cache extension, to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation in the wild. The…Read more ...
3 weeks ago
References
EPSS Score
27% chance of being exploited in the next 30 days.
CVSS V4
Timeline
- 🟡
Public PoC available
- 📰
First article discovered by Securityweek
- 👾
Exploit known to exist
- 🦅
CISA Reported
Vulnerability published
Vulnerability Reserved