CVE-2026-45247 Mirasvit Full Page Cache Warmer For Magento 2
Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie.…
- CVSS
- 9.3 Critical
- EPSS
- 26%
- Percentile
- 98
- Published
- 2026-05-26
- Force
- 10 of 12
- Public PoC
- 2
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
On CISA’s exploited list
Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability
- Added
- 2026-06-03
- Federal patch deadline
- 2026-06-06
- Ransomware use
- not known