CISA Warns of Critical Magento Cache Warmer RCE Flaw Exploited in Attacks

Key Takeaways

• A critical remote code execution (RCE) vulnerability, CVE-2026-45247, has been identified in the Mirasvit Full Page Cache Warmer extension for Magento.
• The flaw, stemming from insecure deserialization, is actively being exploited in the wild, posing a significant threat to eCommerce platforms.
• Unauthenticated attackers can leverage this vulnerability to execute arbitrary code on affected Magento stores without needing credentials.
• CISA has added this CVE to its Known Exploited Vulnerabilities catalog, urging immediate remediation, especially for federal agencies.
• Organizations utilizing the Mirasvit Full Page Cache Warmer extension should apply available patches or disable the component if no fix exists.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert concerning a severe remote code execution vulnerability, designated as CVE-2026-45247. This critical flaw impacts the Mirasvit Full Page Cache Warmer extension, widely used in Magento eCommerce environments.

The vulnerability arises from insecure deserialization of untrusted data, and cybersecurity experts confirm it is currently being exploited in active attacks. This development presents a substantial risk to online stores built on the Magento platform that rely on the affected extension.

Technical Details of the RCE Flaw

CISA’s advisory clarifies that the vulnerability resides within the extension’s handling of serialized PHP objects transmitted via the CacheWarmer cookie. An attacker, even without authentication, can craft a malicious serialized payload. By sending this payload through the CacheWarmer cookie, they can trigger unsafe deserialization on the server.

This malicious process enables arbitrary code execution on the server without requiring any form of authentication, making it an exceptionally dangerous threat for internet-facing Magento installations.

The issue is categorized under CWE-502, which specifically addresses the deserialization of untrusted data—a common and frequently exploited class of vulnerabilities in web applications.

Impact and Active Exploitation

Successful exploitation of CVE-2026-45247 grants attackers the ability to execute system commands, install backdoors, and further infiltrate the hosting environment. Given Magento’s extensive adoption across enterprise and mid-sized eCommerce operations, the potential attack surface is considerable.

CISA officially added CVE-2026-45247 to its Known Exploited Vulnerabilities (KEV) catalog on June 3, 2026, confirming that the flaw is under active exploitation. In response, federal agencies and organizations are mandated to remediate this vulnerability by June 6, 2026, in accordance with Binding Operational Directive (BOD) 22-01.

While there is no public confirmation linking this specific vulnerability to ransomware campaigns at present, its nature makes it highly attractive to initial access brokers and financially motivated threat actors seeking to gain a foothold in valuable systems.

Indicators of Compromise and Mitigation

Security researchers indicate that exploitation attempts may manifest as suspicious HTTP requests containing a manipulated “CacheWarmer” cookie, often embedding encoded PHP object payloads. Potential indicators of compromise (IOCs) include the appearance of unexpected web server processes, unauthorized file creation within Magento directories, or outbound network connections to unknown IP addresses post-exploitation.

Application logs may also reveal unusual cookie values or repeated requests targeting cache warming endpoints. Organizations that utilize the Mirasvit Full Page Cache Warmer extension are strongly urged to apply any vendor-provided patches or mitigations immediately.

If a patch is not yet available, CISA recommends completely disabling or removing the affected component to eliminate exposure.

What You Should Do

• Patch Immediately: Apply all available security patches or updates for the Mirasvit Full Page Cache Warmer extension as soon as they are released by the vendor.
• Disable or Remove: If a patch is not available, disable or completely remove the Mirasvit Full Page Cache Warmer extension from your Magento environment to mitigate the risk.
• Implement WAF Rules: Configure your Web Application Firewall (WAF) to inspect and block suspicious serialized input, particularly within the “CacheWarmer” cookie.
• Monitor Logs: Regularly monitor application and web server logs for anomalies, unexpected processes, unauthorized file changes, and unusual outbound connections. Pay close attention to requests targeting cache warming endpoints.
• Review Third-Party Extensions: Conduct periodic security reviews of all third-party Magento extensions to ensure they adhere to secure coding practices and do not introduce new vulnerabilities.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.