{"id":"mirasvit-cache-warmer-attacks-jun-2026","category":"patch","status":"closed","title":"Mirasvit Full Page Cache Warmer CVE-2026-45247 exploited to run code on online shops; fix available","tldr":"Attackers are exploiting Mirasvit Full Page Cache Warmer versions before 1.11.12 on Magento and Adobe Commerce shops. Store operators should update the extension and have their developer check for signs of compromise.","summary":"CVE-2026-45247 affects Mirasvit Full Page Cache Warmer, an extension used by Magento and Adobe Commerce online shops. It mishandles untrusted data in a cookie, allowing an attacker to run code on the shop’s server without signing in. Versions before 1.11.12 are affected, including installations bundled with other Mirasvit packages. Mirasvit released the fix on 25 May, and Sansec disclosed the flaw the following day. Imperva reported attack attempts by 29 May; CISA added it to its exploited-vulnerability catalogue on 3 June. As at 3 November, the fix is available in 1.11.12 and later releases. Operators should also check for an earlier compromise. The reviewed sources do not establish how many shops were compromised, whether customer information was stolen, or whether attacks have ended.","action":"If your family or business runs a Magento or Adobe Commerce shop, ask its developer to check for Mirasvit Full Page Cache Warmer, including bundled installations, and update it to 1.11.12 or later. Ask them to review server logs and check for malicious files as well. Shoppers have no extension on their own devices to update.","product":"Mirasvit Full Page Cache Warmer for Magento 2","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-45247"],"tags":["mirasvit","magento","adobe-commerce","remote-code-execution","actively-exploited"],"affected":["Mirasvit Full Page Cache Warmer for Magento 2 versions before 1.11.12"],"fixed":["Mirasvit Full Page Cache Warmer for Magento 2 1.11.12"],"matches":[],"sources":[{"kind":"advisory","title":"Full Page Cache Warmer for Magento 2 — What's New","url":"https://mirasvit.com/package/changelog/?package=mirasvit/module-cache-warmer","by":"Mirasvit","date":"2026-05-25"},{"kind":"research","title":"Critical vulnerability in Mirasvit Cache Warmer for Magento","url":"https://sansec.io/research/mirasvit-cache-warmer-object-injection","by":"Sansec","date":"2026-05-26"},{"kind":"research","title":"Imperva Customers Protected Against CVE-2026-45247 in Mirasvit Full Page Cache Warmer for Magento","url":"https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-45247-in-mirasvit-full-page-cache-warmer-for-magento/","by":"Imperva","date":"2026-05-29"},{"kind":"advisory","title":"CVE-2026-45247 Detail","url":"https://nvd.nist.gov/vuln/detail/cve-2026-45247","by":"NIST NVD","date":"2026-05-26"},{"kind":"news","title":"Mirasvit Vulnerability Exploited to Execute Code on Magento Servers","url":"https://www.securityweek.com/mirasvit-vulnerability-exploited-to-execute-code-on-magento-servers/","by":"SecurityWeek","date":"2026-06-04"}],"started":"2026-06-03","closed":"2026-06-03","created":"2026-11-03T22:18:50.400Z","updated":"2026-11-03T22:18:50.400Z","cve_notes":[{"cve":"CVE-2026-45247","name":"Unsafe cookie deserialisation in Mirasvit Cache Warmer","what":"Mirasvit Full Page Cache Warmer improperly rebuilds PHP objects from untrusted cookie data, allowing an unauthenticated attacker to run code on a Magento or Adobe Commerce server.","severity":"critical","cvss":9.8}],"timeline":[{"at":"2026-06-03","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2026-45247 to its Known Exploited Vulnerabilities catalogue, with a 6 June remediation deadline for US federal civilian agencies.","url":"https://nvd.nist.gov/vuln/detail/cve-2026-45247","by":"NIST NVD","patch":null},{"at":"2026-05-29","added":"2026-11-03T22:11:23.504Z","kind":"wider-attacks","text":"Imperva reported exploitation attempts since disclosure, including requests intended to test whether attackers could run commands on vulnerable servers.","url":"https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-45247-in-mirasvit-full-page-cache-warmer-for-magento/","by":"Imperva","patch":null},{"at":"2026-05-26","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"Sansec published its advisory for CVE-2026-45247. It warned that the extension can also arrive bundled with other Mirasvit packages.","url":"https://sansec.io/research/mirasvit-cache-warmer-object-injection","by":"Sansec","patch":null},{"at":"2026-05-25","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Mirasvit released Full Page Cache Warmer 1.11.12, fixing PHP object injection in session-cookie handling.","url":"https://mirasvit.com/package/changelog/?package=mirasvit/module-cache-warmer","by":"Mirasvit","patch":"patched"},{"at":"2026-05-21","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"Sansec notified Mirasvit about the vulnerability.","url":"https://sansec.io/research/mirasvit-cache-warmer-object-injection","by":"Sansec","patch":"none"},{"at":"2026-04-24","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"Sansec discovered the flaw and deployed protection for its Sansec Shield customers.","url":"https://sansec.io/research/mirasvit-cache-warmer-object-injection","by":"Sansec","patch":null}],"url":"https://hard.fyi/live/mirasvit-cache-warmer-attacks-jun-2026/","json":"https://hard.fyi/api/live?id=mirasvit-cache-warmer-attacks-jun-2026"}