Mirasvit Cache Warmer CVE-2026-45247: Magento Cookie RCE
If any Magento store you run has Mirasvit Cache Warmer, including as part of another Mirasvit package, make sure it is on 1.11.12 or later (1.11.16 adds more cookie hardening) and check for webshells if it was behind in late May or June 2026.
Must act: Magento Open Source and Adobe Commerce merchants and agencies whose stores include mirasvit/module-cache-warmer, directly or bundled with other Mirasvit extensions.
Can relax: Stores without any Mirasvit cache warmer module, and non-Magento sites; the flaw is in this extension, not Magento core.
- Run composer show mirasvit/module-cache-warmer on every Magento codebase, including ones where you never installed it directly.
- Update to 1.11.16 or later (at minimum 1.11.12), then run bin/magento setup:upgrade and redeploy.
- Block requests whose CacheWarmer cookie matches CacheWarmer:(Tz|Qz|YT) at your WAF or CDN.