CVE-2026-45247 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-45247CRITICAL

Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .2755   97.9   YES

AFFECTED
  Product                               Versions     Fixed
  Full Page Cache Warmer for Magento 2  unspecified  —

TIMELINE
  May 11  Reserved by VulnCheck
  Jun 3   Added to CISA KEV, remediation due 2026-06-06
  Jun 3   Published (CNA: VulnCheck)
  Jun 7   DUE DATE PASSED — CVE-2026-45247 (Mirasvit Full Page Cache Warmer for Magento 2). CISA remediation deadline was June 6, 2026; still in catalog.
  Jul 24  ENRICHED — CVE-2026-45247 (Mirasvit Full Page Cache Warmer). Received CVSS 9.3 and CPE data from NVD.

CWE-502 · CNA: VulnCheck · CVSS v4.0 · 5 references · NVD status: Analyzed · KEV due June 6, 2026

Description

Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Attackers can exploit the unrestricted call to PHP's native unserialize() function combined with gadget chains available in Magento and its dependencies to execute arbitrary code on the server.

Lifecycle

Complete event history — 5 events, chronological
Date	Event	Detail
May 11, 2026	Reserved	Reserved by VulnCheck
June 3, 2026	KEV ADDED	Added to CISA KEV, remediation due 2026-06-06
June 3, 2026	Published	Published (CNA: VulnCheck)
June 7, 2026	DUE DATE PASSED	DUE DATE PASSED — CVE-2026-45247 (Mirasvit Full Page Cache Warmer for Magento 2). CISA remediation deadline was June 6, 2026; still in catalog.
July 24, 2026	ENRICHED	ENRICHED — CVE-2026-45247 (Mirasvit Full Page Cache Warmer). Received CVSS 9.3 and CPE data from NVD.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Mirasvit	Full Page Cache Warmer for Magento 2	—	—	—

Weaknesses

CWE-502

References (5)

https://mirasvit.com/package/changelog/?package=mirasvit/module-cache-warmer [Release Notes]
https://sansec.io/research/mirasvit-cache-warmer-object-injection [Third Party Advisory]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45247 [US Government Resource]
https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-45247-in-mirasvit-full-page-cache-warmer-for-magento/ [Third Party Advisory]
https://www.vulncheck.com/advisories/mirasvit-cache-warmer-for-magento-php-object-injection [Third Party Advisory]

Authoritative record: CVE-2026-45247 at cve.org

Vendors: mirasvit

Weaknesses: CWE-502

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-45247 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.