Unauthenticated PHP Object Injection RCE in Mirasvit Cache Warmer for Magento (CVE-2026-45247)

Vulnerability Overview Sansec has discovered an unauthenticated PHP object injection vulnerability in Mirasvit Cache Warmer, a popular Magento full-page cache extension. Any frontend page request with a specially crafted cookie can lead to remote code execution. Mirasvit has released a patched version. Affected Versions All versions of Mirasvit Cache Warmer prior to 1.11.2 are vulnerable. The extension is bundled with several Mirasvit packages, so many merchants run it without having installed it directly. Sansec scans have identified approximately 6,000 stores running Mirasvit extensions. The actual number may be higher, as content delivery networks like Cloudflare hide many installations. Remediation 1. Update Immediately: Upgrade to Mirasvit Cache Warmer version 1.11.2 or later. 2. Block Attacks: Deploy Sansec Shield to block exploitation attempts in real-time, including for stores that cannot be patched immediately. 3. Scan for Compromises: Run eComscan to detect webshells, backdoors, and other malware. 4. Check Accessible Directories: Review and other web-accessible folders for unexpected PHP files. POC Code Timeline April 24, 2026: Sansec discovers the vulnerability. April 24, 2026: Sansec Shield rules deployed. May 21, 2026: Mirasvit notified. May 25, 2026: Mirasvit releases patched version 1.11.2. May 26, 2026: CVE-2026-45247 assigned (severity 9.8). May 26, 2026: This advisory published. Detection The attack leaves a clear request signature. Look for frontend requests with a cookie whose value contains the marker followed by a base64 string. The base64-encoded value of the serialized PHP object starts with , , or , so a cookie value matching is a strong indicator of exploitation attempts. Recommendations 1. Update Immediately: Upgrade to Mirasvit Cache Warmer version 1.11.2 or later. 2. Block Attacks: Deploy Sansec Shield to block exploitation attempts in real-time. 3. Scan for Compromises: Run eComscan to detect webshells, backdoors, and other malware. 4. Check Accessible Directories: Review and other web-accessible folders for unexpected PHP files. More Information Adobe Patches Critical Magento Admin Takeover Vulnerability Magento Security Release APSB25-08 (Impact Analysis) CosmicSting Attack and Defense Overview Persistent Backdoor Injection in Adobe Commerce via CosmicSting Attack CosmicSting Attack Threatens 75% of Adobe Commerce Stores Tags magento adobe-commerce vulnerability vendor Scan Your Store eComscan is the most thorough security scanner for Magento, Adobe Commerce, Shopify, WooCommerce, and more. Subscribe Stay up to date with the latest eCommerce attacks. Contact Information Sansec BV Wolverplein 25 3512 CK Utrecht The Netherlands info@sansec.io Social Media Twitter LinkedIn Email RSS Legal Information Terms & Conditions • Privacy & Cookie Policy • Company Reg 77165187 • Tax NL860920306B01 Expertise eCommerce security

Goal Reached Thanks to every supporter — we hit 100%!

Unauthenticated PHP Object Injection RCE in Mirasvit Cache Warmer for Magento (CVE-2026-45247)