Mirasvit Cache Warmer CVE-2026-45247: Magento Cookie RCE

What to do

1. Run composer show mirasvit/module-cache-warmer on every Magento codebase, including ones where you never installed it directly.
2. Update to 1.11.16 or later (at minimum 1.11.12), then run bin/magento setup:upgrade and redeploy.
3. Block requests whose CacheWarmer cookie matches CacheWarmer:(Tz|Qz|YT) at your WAF or CDN.
4. If the store ran a vulnerable version after May 26, 2026, scan for webshells and unexpected PHP files under pub/ and rotate admin, database and payment credentials.
5. Check checkout pages and the core_config_data table for injected JavaScript skimmers.

How to check if you are affected or compromised

• Search WAF, CDN or reverse-proxy logs for CacheWarmer cookie values matching CacheWarmer:(Tz|Qz|YT); Sansec calls this a strong exploitation indicator.
• Look for requests or command output containing PWNED_CVE2026_ or timing probes with sleep 5, which Imperva saw in test payloads.
• Compare pub/ and other web-reachable folders against a clean deployment and flag any PHP file you did not ship.
• Review outbound connections and new cron entries on the web server since late May 2026.

What happened#

Mirasvit Full Page Cache Warmer is a Magento 2 extension that pre-loads pages into the full-page cache. Before version 1.11.12, it passed the value of a CacheWarmer cookie straight to PHP's unserialize(). Sansec, which found the bug on April 24, 2026, notes that the plugin runs on "every" storefront request, not just warmer traffic. An unauthenticated visitor can send a crafted serialized object and, using gadget chains in Magento and its libraries, run code on the server. Sansec told Mirasvit on May 21. Mirasvit shipped 1.11.12 on May 25, with a changelog line that reads "Fixed PHP Object Injection vulnerability in session cookie deserialization." Sansec published on May 26, the same day the CVE record appeared. VulnCheck, the CNA, scores it CVSS 3.1 9.8 and CVSS 4.0 9.3.

Attacks followed quickly. On May 29, Imperva reported exploitation attempts using base64-encoded serialized objects built from Monolog logging classes to call system(). Test commands such as echo PWNED_CVE2026_$(date +%s) and sleep 5 suggested attackers were confirming code execution before going further. CISA added the CVE to the KEV catalog on June 3, with a June 6 deadline.

Who is affected#

Any Magento Open Source or Adobe Commerce store running mirasvit/module-cache-warmer before 1.11.12. Sansec warns that the module is bundled with several Mirasvit packages, so some merchants run it without knowing. Its scans found about 6,000 stores with Mirasvit extensions, likely an undercount because CDNs hide many installs. A later release, 1.11.16 (September 7), fixes two more issues: forged warmer cookies and anonymous emptying of the full-page cache.

Do you really need to act?#

Only if the module is present, but then the stakes are high. Exploitation needs no login and no special setup. Magento's dependency tree supplies working gadget chains, and Imperva saw probing within three days of disclosure. A store that stayed on an old version into June should be treated as possibly compromised, since an upgrade does not remove a webshell or a payment skimmer. The Hacker News found no attribution, and the end goal was not disclosed as of Oct 23, 2026. Ecommerce intrusions often end in card skimming, so check checkout pages as well as server files.

What to do now#

1. On every Magento codebase, run composer show mirasvit/module-cache-warmer. Check bundles too: composer why mirasvit/module-cache-warmer.
2. Update with composer update mirasvit/module-cache-warmer --with-dependencies to 1.11.16 or later, then run bin/magento setup:upgrade and redeploy.
3. At your WAF or CDN, block CacheWarmer cookies matching CacheWarmer:(Tz|Qz|YT), the pattern Sansec published.
4. If a vulnerable version was live after May 26, hunt as below and rotate admin, database, API and payment credentials.

How to tell if you were hit#

Web server access logs usually omit cookies, so look in WAF, CDN or proxy logs for the cookie pattern above. Search for the Imperva test strings. Compare pub/ and other web-reachable folders against a clean deployment and flag any PHP file you did not ship. Check checkout pages and core_config_data for injected JavaScript, and review new cron entries and outbound connections from the web server since late May.

Timeline#

• Apr 24, 2026 — Sansec discovers the flaw.
• May 21, 2026 — Sansec notifies Mirasvit.
• May 25, 2026 — Mirasvit releases 1.11.12.
• May 26, 2026 — Sansec advisory and CVE published.
• May 29, 2026 — Imperva reports active exploitation attempts.
• Jun 3, 2026 — CISA adds the CVE to KEV.
• Sep 7, 2026 — Mirasvit 1.11.16 adds further cookie hardening.

Vulnerability records

• CVE-2026-45247 · KEV 2026-06-03 · Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Sansec — Critical vulnerability in Mirasvit Cache Warmer for Magento sansec.io
2. Mirasvit — Changelog: mirasvit/module-cache-warmer mirasvit.com
3. CVE record — CVE-2026-45247 cve.org
4. CISA — Known Exploited Vulnerabilities: CVE-2026-45247 cisa.gov
5. VulnCheck — Mirasvit Cache Warmer for Magento PHP Object Injection vulncheck.com
6. Imperva — Imperva customers protected against CVE-2026-45247 in Mirasvit Full Page Cache Warmer for Magento imperva.com

Coverage and analysis

1. The Hacker News — CISA adds exploited Magento RCE flaw thehackernews.com