CVE-2026-45247KEV · OVERDUECWE-502

Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection

Critical · published May 26, 2026

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.3. It is confirmed in active exploitation. It sits in the 81.4th percentile for exploit probability.

139
days past CISA
deadline
CVSS v4.0
9.3
EPSS
2%
Percentile
81.4
In the wild
Confirmed
What it is

Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Attackers can exploit the unrestricted call to PHP's native unserialize() function combined with gadget chains available in Magento and its dependencies to execute arbitrary code on the server.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.02085 · 81.4th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-05-26T14:15Z
KEV added
2026-06-03 · due 2026-06-06
EPSS history
Timeline
  • 25 SEP 03:26Z
    EPSS moved 28% → 2%
    epss
  • 03 JUN 00:00Z
    Added to CISA KEV — remediate by Jun 6
    kev
  • 26 MAY 14:15Z
    Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection
    cvelistv5