CVE-2026-45247: Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability
Mirasvit Full Page Cache Warmer contains a deserialization of untrusted data vulnerability that could allow unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie.
Overview
The Mirasvit Full Page Cache Warmer extension for Magento 2 passes a client-supplied cookie value directly to PHP's native unserialize() function without restricting which classes may be instantiated. An unauthenticated attacker can send a single crafted HTTP request to any storefront page and achieve remote code execution on the server. All versions of the extension before 1.11.12 are affected, including installations bundled with other Mirasvit packages.
Vulnerability details
The extension pre-populates Magento's full-page cache by crawling storefront pages with session state packed into a CacheWarmer cookie. A plugin reads that cookie on every storefront request and passes part of its value to PHP's native unserialize() without a class allowlist. This is a textbook CWE-502 (Deserialization of Untrusted Data) condition: because PHP reconstructs arbitrary class instances from the supplied byte stream, an attacker who controls the cookie value controls which objects are instantiated and how their magic methods execute during deserialization.
An attacker sends a standard HTTP GET or POST request to any Magento storefront page, setting the CacheWarmer cookie to a base64-encoded, serialized PHP gadget-chain payload built from classes already present in Magento and its dependencies. No authentication, admin session, or configuration change is required. Successful exploitation gives the attacker unauthenticated remote code execution on the server, with the ability to plant webshells, backdoors, or other malware in web-accessible directories.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Inspect web server or WAF access logs for requests to any storefront path where the CacheWarmer cookie value matches the pattern CacheWarmer:(Tz|Qz|YT), indicating a base64-encoded serialized PHP object rather than a legitimate warmer session state.
- Audit web-accessible directories, particularly pub/ and its subdirectories, for unexpected PHP files created after the extension was installed. New PHP files in those paths with no corresponding deployment event are a strong post-exploitation indicator.
Remediation
Additional hardening
- Upgrade Mirasvit Full Page Cache Warmer to version 1.11.12 or later. Stores that installed the extension as part of a Mirasvit bundle should verify the bundled module version independently, as the extension may be present without a direct installation record.
- At the WAF or CDN layer, block or alert on requests where the CacheWarmer cookie value matches the base64 serialized-object prefix pattern (Tz, Qz, or YT following the CacheWarmer: marker) to stop exploitation attempts against unpatched stores.
- Review pub/ and other web-reachable directories for unexpected PHP files. Any file created outside a normal deployment window should be treated as a potential webshell and investigated before the store is returned to production.
Key dates
References
- https://mirasvit.com/package/changelog/?package=mirasvit/module-cache-warmer
- https://nvd.nist.gov/vuln/detail/CVE-2026-45247
- https://sansec.io/research/mirasvit-cache-warmer-object-injection
- https://www.vulncheck.com/advisories/mirasvit-cache-warmer-for-magento-php-object-injection
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45247
- https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-45247-in-mirasvit-full-page-cache-warmer-for-magento/
Frequently asked questions
Does CVE-2026-45247 affect my FedRAMP authorization?
If Mirasvit Full Page Cache Warmer runs inside your authorization boundary, CVE-2026-45247 affects your FedRAMP authorization directly. The vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of June 6, 2026, a date that has already passed. An unpatched KEV inside your boundary is an assessor finding; an overdue one is already visible to your assessor and sponsoring agency. Remediate now or formally document your mitigation and the delay.
How does Knox help me handle CVE-2026-45247?
Knox does not patch your software. Remediating Mirasvit Full Page Cache Warmer is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, plus Knox's automated continuous monitoring platform and audit-artifact coverage that document the fix for your next assessment. Applying the patch is yours to own; maintaining a defensible compliance posture while you do it is not something you have to manage alone.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues on a continuous basis. For a vulnerability like CVE-2026-45247, that means exposure surfaces during ongoing monitoring rather than only when an assessor flags it at review time, giving you a narrower window of undetected risk.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2026-45247's remediation deadline of June 6, 2026 has passed. What happens now?
If CVE-2026-45247 remains unremediated, it is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is precisely what turns a routine continuous-monitoring review into a difficult agency conversation. Closing the finding out and documenting why the deadline was missed is what keeps your authorization intact and the agency relationship on solid ground.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
