CVE-2026-45247: Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability — Fixed versions

Summary

Mirasvit Full Page Cache Warmer contains a deserialization of untrusted data vulnerability that could allow unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie.

Remediation

Inventory every Mirasvit Mirasvit Full Page Cache Warmer deployment, including staging.
Upgrade Mirasvit Mirasvit Full Page Cache Warmer to 1.11.12.
Confirm the running version after the upgrade.
Review logs from before the change for signs of exploitation.

CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

References

Patchhttps://mirasvit.com/package/changelog/?package=mirasvit/module-cache-warmer
Advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2026-45247
Advisoryhttps://www.vulncheck.com/advisories/mirasvit-cache-warmer-for-magento-php-object-injection
Referencehttps://sansec.io/research/mirasvit-cache-warmer-object-injection
Referencehttps://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-45247-in-mirasvit-full-page-cache-warmer-for-magento/
Referencehttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45247