CISA Adds Exploited Magento RCE Flaw CVE-2026-45247 to KEV Catalog
CISA added a critical Magento extension flaw to its KEV catalog after reports of active exploitation. The bug can let unauthenticated attackers run PHP code.
Intelligence analysis by GPT-5.4 Mini
CVE-2026-45247 affects Mirasvit Cache Warmer, a Magento cache extension, and can be triggered through a crafted CacheWarmer cookie. CISA moved it into the KEV catalog after active exploitation reports, while security firms say attackers are already probing stores for remote code execution.
A store plugin had a broken mailbox slot: if someone drops in a tricky note, the store’s computer may follow the note’s hidden instructions. That can let a stranger take over the machine, like sneaking into the control room through the front door.
Analysis
What happened
CISA added CVE-2026-45247 to its Known Exploited Vulnerabilities catalog after reports that attackers were exploiting a critical issue in Mirasvit Cache Warmer, a Magento full-page cache extension. The flaw has a CVSS score of 9.8 and affects all versions before 1.11.12; patches were released on May 25, 2026.
How the bug works
According to CISA, the problem is a deserialization of untrusted data issue that can let an unauthenticated attacker reach remote code execution by sending a crafted serialized PHP object in the CacheWarmer cookie. Sansec said the flaw can be triggered by ordinary storefront requests, because the extension passes part of the cookie value into PHP's native unserialize() without requiring login or admin access. Sansec also said the issue becomes full RCE when combined with gadget chains already present in Magento and its dependencies.
Evidence of exploitation
Sansec estimated about 6,000 stores run Mirasvit extensions, though the real number may be higher because CDNs can hide installs. Imperva later said it observed active attacks using serialized PHP object payloads in malicious HTTP requests. The company said the payloads attempted to invoke functions such as system() and current(), and in some cases used test commands to confirm code execution.
Defensive takeaway
The activity has mostly targeted gaming and business sites, with the U.S., the U.K., France, and Australia among the most targeted countries. FCEB agencies must apply fixes by June 6, 2026. Sansec advised site owners to audit storefront traffic for CacheWarmer cookies containing CacheWarmer: followed by Base64 data, with values starting Tz, Qz, or YT standing out as strong indicators of exploitation attempts.
Key points
- CISA added CVE-2026-45247 to the KEV catalog after reports of active exploitation.
- The flaw affects Mirasvit Cache Warmer versions before 1.11.12 and can lead to remote code execution.
- Sansec said the bug can be triggered by a crafted CacheWarmer cookie in ordinary storefront requests.
- Imperva reported malicious requests carrying serialized PHP object payloads and signs of command execution attempts.
- FCEB agencies must apply the fixes by June 6, 2026.
CISA’s KEV listing should push administrators to treat the flaw as urgent and patch quickly. The article also gives defenders a concrete detection clue, which could help identify abuse in logs before more damage is done.
Any store still running an affected version can be hit without login credentials, so unpatched systems remain exposed to remote code execution. The true scale of exposure may be larger than it looks because CDNs can mask which sites are using the extension.
