Magento Cache Warmer RCE: CVE-2026-45247 Hits Stores

Cache warming sounds boring. It is the unglamorous job of pre populating an e commerce site's page cache so that the first real shopper does not wait three seconds for a product page. Mirasvit's Full Page Cache Warmer is a popular Magento extension that does exactly that. As of June 3, it is also the latest piece of Magento ecosystem code that an attacker can use to take over your storefront from the public internet with no login.

Key Takeaways

• CVE-2026-45247 is a CVSS 9.8 deserialization of untrusted data flaw in Mirasvit Full Page Cache Warmer for Adobe Commerce and Magento.
• An unauthenticated attacker triggers remote code execution by sending a crafted serialized PHP object inside the CacheWarmer cookie.
• The bug affects all extension versions prior to 1.11.12, which shipped as a patched release on May 25, 2026.
• CISA added the CVE to its KEV catalog on June 3, 2026 with a June 6 federal remediation deadline under BOD 22-01.
• Imperva has observed live exploitation payloads containing base64 encoded serialized PHP objects designed to trigger common gadget chain remote code execution.

What Is the Mirasvit Cache Warmer Flaw?

The vulnerability is a textbook PHP object injection. The extension reads a cookie named CacheWarmer, base64 decodes its value, and hands the resulting blob to PHP's native unserialize() function — without verifying that the calling user has any authority to drive cache warming behavior in the first place. PHP's unserialize() is a known dangerous primitive on untrusted input because it constructs objects of any class declared in the application, then triggers magic methods like __wakeup() and __destruct() that can be chained together into "gadget chains" leading to arbitrary code execution.

Magento and Adobe Commerce ship with a rich object graph. Anyone who has worked on Magento exploitation already knows several reliable gadget chains that end in shell command execution. The Mirasvit bug hands an attacker a pre authenticated entry point to that gadget vocabulary.

How Are Attackers Exploiting It Right Now?

Imperva published telemetry showing real attack traffic: HTTP requests carrying a CacheWarmer cookie whose value, once base64 decoded, contains a serialized PHP object referencing common Magento and third party library classes. The payloads chain those classes together to invoke either system() or eval() on the underlying server. The end state is the standard Magecart playbook — drop a small skimmer into the checkout flow that captures payment card numbers, postal addresses, and the customer email and phone number on submission, and post the harvest to an attacker controlled exfiltration endpoint.

A skimmer on a Magento storefront is the perfect downstream of a remote code execution bug. The attacker does not need to encrypt anything, blackmail anyone, or even maintain persistence for long. They just need the checkout traffic to flow through their JavaScript for a few weeks before the merchant notices the chargeback wave.

Why Does This Affect Email Privacy?

Storefront compromises do not stop at credit card numbers. Magento checkout flows collect the customer's email address — and that address is then used as the anchor for phishing campaigns. Once an attacker knows you bought from a specific store within a specific window, they can send a perfectly tailored shipping confirmation lookalike that drops malware or harvests credentials. Modern carding crews routinely sell their checkout exfil feeds twice — once to the credit card carders, once to the email phishing crews.

The Rutgers research we covered in the Rutgers tracking pixel hospital breach study made the same point on the medical side — adding third party scripts to a site that handles sensitive customer data measurably increases breach risk. The Mirasvit extension is structurally similar: a third party PHP module sitting in a sensitive transactional path on tens of thousands of merchant sites.

What Operators Should Do Today

• Upgrade Mirasvit Full Page Cache Warmer to version 1.11.12 or later. The patch was released May 25, 2026.
• If you cannot patch immediately, block any incoming request whose Cookie header includes a CacheWarmer key at your CDN or web application firewall.
• Pull the last 30 days of access logs and grep for CacheWarmer cookies. If you find any from a non operational IP range, treat the host as potentially compromised.
• Inspect checkout JavaScript for unauthorized additions. Magecart skimmers usually live in a single concatenated script tag or in the Mage_Checkout module.
• If you find evidence of compromise, do not assume a clean uninstall purges the foothold. Magento exploitation routinely plants admin user accounts, cron jobs, and database persistence outside the file system path.

For an earlier large scale Magento ecosystem incident, see our coverage of the 7,500 Magento sites mass defacement.

The Wider Pattern

Every meaningful Magento RCE in the last five years has ended in skimmer deployment and customer email exfiltration. The Mirasvit bug will follow the same arc unless merchants patch in the next few days. The federal June 6 deadline is a tight one for any agency running an e commerce front end — and a useful forcing function for everyone else.