CVE-2026-45247 — Mirasvit Mirasvit Full Page Cache Warmer: Insecure Deserialization | CVSS 9.3 CRITICAL

CRITICAL

CVSS 9.3 CRITICAL  ·  EPSS 0%  ·  Mirasvit Mirasvit Full Page Cache Warmer

Severity Overview

Summary

Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Attackers can exploit the unrestricted call to PHP's native unserialize() function combined with gadget chains available in Magento and its dependencies to execute arbitrary code on the server.

What the Attack Looks Like

How it works: The application deserializes untrusted data without validation. A crafted payload triggers arbitrary code execution during the deserialization process itself.

Analyst Takeaway

The attack is launched over the network (remotely exploitable without physical access) and no authentication is required. This vulnerability is already in CISA KEV, which means exploitation has been confirmed in the wild — treat this as active risk, not theoretical exposure. The CVSS score places this in critical territory, so internet-facing systems and high-value assets should be prioritized for immediate remediation or compensating controls. In parallel with patching, defenders should review external exposure, hunt for signs of exploitation, and validate whether compensating controls are in place for vulnerable assets.

Detection Guidance

• CWE-502 — Deserialization of Untrusted Data
  • Serialized data in requests: Search request bodies and cookies for known serialization format signatures: Java (AC ED 00 05 hex / rO0 base64), PHP (O: object notation), Python pickle (\x80\x02 or cos), .NET ViewState.
  • Process execution post-deserialization: Deserialization exploits frequently trigger process execution during the deserialization step itself. Hunt for unexpected child processes spawned by the application process — especially Java apps spawning bash or PowerShell.
  • Network callbacks (out-of-band detection): Many deserialization exploits use DNS or HTTP callbacks to confirm exploitation. Monitor for unexpected outbound DNS lookups or HTTP requests from the application server, particularly to services like Burp Collaborator or Interactsh infrastructure.

Recommended Actions

Immediate (0–24 Hours)

• Inventory: Identify all systems running Mirasvit Mirasvit Full Page Cache Warmer. Include production, staging, dev, and cloud environments — untracked instances are the most likely to remain unpatched.
• Validate internet-facing exposure: Determine which of the affected systems are reachable from the public internet. Prioritize these for immediate remediation or compensating controls.
• Apply compensating controls now: For systems that cannot be patched immediately, implement temporary mitigations: restrict access via firewall rules or ACLs, add WAF rules if applicable, disable or isolate the vulnerable component if feasible without breaking critical operations.

Remediation

• Apply the vendor patch: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
• CISA directive deadline: 2026-06-06 — this is the mandatory deadline for US federal civilian agencies under BOD 22-01. All organizations should treat this date as a strong target regardless of federal mandate.
• Verify remediation: After patching, confirm the correct version is installed on all affected hosts. Run a vulnerability scan or use your asset management tooling to verify — do not rely solely on change tickets.

Detection Coverage

• Unauthenticated exploitation monitoring: Because this vulnerability requires no authentication, internet-facing scanning and exploitation attempts may begin within hours of public disclosure. Ensure alerting is in place before the end of the day.
• Threat intelligence feeds: Monitor your TI feeds and vendor advisory channels for published indicators of compromise (IOCs), proof-of-concept exploit releases, or active campaign reporting associated with this CVE — these should trigger an immediate hunt even if no internal alerts have fired.

Vulnerability Details

Additional Notes

https://mirasvit.com/package/changelog/?package=mirasvit/module-cache-warmer ; https://nvd.nist.gov/vuln/detail/CVE-2026-45247