# CVE-2026-45247: Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability

- Exploited (CISA KEV): yes, added 2026-06-03
- Published: 2026-05-26
- CVSS: 9.3 CRITICAL (v4.0)
- EPSS: 26.2% (98th percentile)
- CWE: CWE-502

Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Attackers can exploit the unrestricted call to PHP's native unserialize() function combined with gadget chains available in Magento and its dependencies to execute arbitrary code on the server.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Blocks by default | 2026-06-09 | 14 |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | Rule published | 2026-07-07 | 42 |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### Cloudflare

- 2026-06-09 · new · rule fb74766654c44ff2a5204dc4e0be4d47 · default Block
  > Mirasvit Cache Warmer - PHP Object Injection - CVE:CVE-2026-45247. Previous action: N/A. New action: Block. This is a new detection.
  Source: https://developers.cloudflare.com/changelog/post/2026-06-09-waf-release/

### F5

- 2026-07-07 · new · rule 200204077
  > Added: signature 200204077 "Magento Mirasvit Cache Warmer Plugin RCE" (Server Side Code Injection, risk High), systems: PHP, Other Web Server. References: CVE-2026-45247.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2026-45247 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2026-45247