CVE-2026-45247: Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability

This vulnerability affects the Mirasvit Full Page Cache Warmer extension and stems from unsafe handling of serialized data. Unauthenticated attackers can supply a crafted serialized PHP object through the CacheWarmer cookie to achieve remote code execution on the server.

The issue is tracked as CVE-2026-45247 and classified under CWE-502. Because the flaw permits code execution without authentication, it can lead to full server compromise if exploited.

How it works

The weakness is deserialization of untrusted data. The application accepts a serialized PHP object in the CacheWarmer cookie and reconstructs it without sufficient validation or type restrictions.

• An attacker crafts a serialized object containing malicious payloads that the PHP deserializer processes upon reconstruction.
• Successful exploitation can result in arbitrary code execution on the web server.
• The attack requires no prior authentication and can be delivered through a single HTTP request containing the manipulated cookie.

Am I affected? How to find it in your systems

Inventory all instances of the Mirasvit Full Page Cache Warmer extension in your Magento or PHP web environments. Examine installed modules, composer manifests, and file-system directories for the extension code.

• Review configuration files and database entries that control cookie handling for the CacheWarmer feature.
• Check application logs for entries referencing the CacheWarmer cookie or deserialization operations that contain unexpected data lengths or object types.
• Confirm exact affected versions and configurations against the vendor advisory, as public detail on version ranges is limited.

How to remediate

Apply mitigations per the vendor instructions referenced in the advisory. The primary action is to update the extension to a version that addresses the deserialization flaw.

• After patching, review any custom code that processes cookies or serialized data and enforce strict type checking and allow-lists for deserialized objects.
• Disable the CacheWarmer cookie feature if it is not required for operations.
• Follow applicable BOD 22-01 guidance for any cloud-hosted instances of the software.

If you can't patch immediately

Until a patch can be applied, implement compensating controls to limit exposure.

• Segment the affected web servers from other internal systems and restrict outbound network access.
• Use web application firewall rules to block or sanitize the CacheWarmer cookie when it contains serialized PHP object markers.
• Monitor logs and network traffic for anomalous cookie values or unexpected process spawns following requests that include the cookie.
• Consider discontinuing use of the product if mitigations cannot be reliably maintained.

If your data may have been exposed

Actively exploited deserialization vulnerabilities have led to breaches in similar products. Review server access logs for suspicious CacheWarmer cookie activity and examine systems for unauthorized code execution or persistence mechanisms.

Run a free exposure scan of your email addresses to check known breach data associated with this or related incidents.