Critical Alert: CVE-2026-45247 exposes Magento stores to remote code execution by deserialization in the Cache Warmer extension

The U.S. Cybersecurity and Infrastructure Agency (CISA) has included in its catalogue of known and exploited vulnerabilities (KEV) a critical failure in the Mirasvit Cache Warmer extension for Magento, registered as CVE-2026-45247 and with CVSS 9.8 score, after reports of active exploitation in e-commerce environments.

This is a vulnerability of deerialization of unreliable data - known as PHP Object Injection - that allows an unauthenticated attacker to supply a malicious serialized PHP object within the CacheWarmer cookie and cause remote code execution (CERs) on the server that runs the vulnerable extension. The corrective patches were published on 25 May 2026 and the failure affects all the versions prior to the 1.11.12.

The risks are high and concrete: a compromised Magento store can serve as a platform to install web shells, deploy cryptominers, pivote into internal systems or filter customer data and transactions. In addition, the attackers are taking advantage of "gadgets" already present in the classes that Magento and its dependencies carry by default, which makes simple deserialization a direct path to CERs without the need for administrative credentials.

Sansec researchers and signatures such as Imperva have observed HTTP requests with serialized base64 charges aimed at triggering dangerous functions in PHP - in some cases trying to invoke system () or equivalent functions to validate remote execution - and have identified abuse patterns that focus on game shops and business sites in countries like the US. United Kingdom, France and Australia. Sansec estimates that at least 6,000 shops use Mirasvit extensions, although the actual figure could be higher when considered as hidden facilities by CDNs.

If you run a Magento store, the first unpostponed action is update the extension to version 1.11.12 or more and apply any available safety patch. Given the ongoing exploitation, U.S. federal entities have already been ordered to mitigate before 6 June 2026; for private environments this urgency must be translated into immediate action.

To detect attempts to operate, it has audited the web access records for applications to the front that include the CacheWarmer cookie with a value containing the prefix CacheWarmer: followed by a base64 chain. Sansec warns that serialized PHP objects encoded in base64 usually start with sequences Tz, Qz or YT, so a cookie whose value coincides with CacheWarmer: (Tz-124; Qz-124; YT) It is a strong indicator of attempted exploitation.

It is not enough to park: if you detect suspicious applications, you assume the possibility of compromise. Isolate the affected host, preserve logs for forensic analysis, search web shells and unusual activities in cron or system processes, break exposed credentials and restart from clean copies if there is evidence of manipulation. It implements WAF rules to block malicious cookies patterns and considers invalidating or filtering CacheWarmer cookies temporarily until complete cleaning is verified.

On the preventive level, it reviews and reduces the exposure surface: it minimizes installed modules and extensions, applies the principle of less privilege to PHP processes and databases, mantenén Magento and all its up-to-date units, and prevents the use of unserialize () in data from the client. For technical equipment, consider safe deerialization bookstores or mechanisms that strictly validate the type and structure of the data before reconstructing objects in memory.

Third-party organizations - CDNs, hosting providers or integrators - should be coordinated to obtain visibility of hidden facilities and ensure that patches are deployed at all points of presence. Stay subscribed to official intelligence sources and vulnerability catalogues to receive early alerts; the CISA KEV catalogue is a good reference point for prioritizing responses: CISA KEV Catalog. The technical analyses and notices of those who discovered the campaign also provide useful indicators of commitment for detection, such as those published by Sansec and security signatures: Sansec and Imperva Blog.

In conclusion, this vulnerability shows how a single insecure function of object management can quickly compromise entire e-commerce ecosystems. The immediate action is to apply the patch, audit and quarantine any operating trace. In the medium term, the lesson is technical and organizational: reduce unnecessary units, apply data entry security controls and maintain well-tested incident response processes to prevent cache extension from becoming the gateway to critical infrastructure.