Loading story…
A critical vulnerability in the Mirasvit Cache Warmer extension for Magento and Adobe Commerce allows unauthenticated attackers to trigger PHP object injection and potentially achieve remote code execution through a crafted CacheWarmer cookie. The flaw, tracked as CVE-2026-45247 and rated 9.8, is caused by unsafe deserialization of attacker-controlled data via PHP unserialize() during normal storefront requests, meaning exploitation does not require an admin session or prior authentication.
Mirasvit released version 1.11.12 to fix the issue, which affects earlier versions of the extension. Researchers said roughly 6,000 stores appear to be running Mirasvit extensions, with the real number potentially higher because CDNs can obscure detection. Defenders were urged to patch immediately, review logs for suspicious base64-encoded serialized object markers such as Tz, Qz, or YT in CacheWarmer cookie values, block exploitation attempts, and investigate for follow-on compromise including webshells, backdoors, and other malware.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
CISA added the Mirasvit Cache Warmer flaw CVE-2026-45247 to its Known Exploited Vulnerabilities catalog after reports of active exploitation. The agency directed Federal Civilian Executive Branch agencies to remediate the issue by 2026-06-06.
Sansec disclosed a critical vulnerability in the Mirasvit Cache Warmer extension affecting versions before 1.11.12, caused by unsafe unserialization of attacker-controlled data in the CacheWarmer cookie. The advisory said the issue requires no authentication, can enable remote code execution, and included detection and remediation guidance.
Mirasvit released version 1.11.12 of its Cache Warmer extension to fix an unauthenticated PHP object injection flaw that can lead to remote code execution in Magento and Adobe Commerce storefronts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
7 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityaffairs.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourcesecurityonline.info
Open sourcesansec.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Adobe disclosed **CVE-2024-34102**, a critical (CVSS 9.8) pre-authentication XML external entity (XXE) flaw in Adobe Commerce and Magento. The vulnerability lies in recursive REST API deserialization and can be reached through an unauthenticated guest-cart shipping-estimation endpoint, allowing attacker-controlled data to instantiate `SimpleXMLElement` objects and retrieve local or remote resources. An attacker could use the flaw to read Magento's `app/etc/env.php`, exposing the installation's cryptographic key and potentially enabling forged administrator JWTs for privileged Magento API access. Research further indicates the issue could be chained with PHP filter techniques and **CVE-2024-2961** toward remote code execution; organizations should apply Adobe's security update, as early third-party emergency mitigations were bypassable and later revised.
Sep 3, 2026
A critical vulnerability in the Magento ecommerce platform, identified as CVE-2025-54236 and dubbed 'SessionReaper,' has been actively exploited in the wild. The flaw allows attackers to hijack user sessions and achieve unauthenticated remote code execution (RCE) on affected Magento installations. Security researchers observed a surge in exploitation attempts following the public release of a proof-of-concept (PoC) exploit, with attackers deploying web shells and conducting reconnaissance using classic PHP probes. Adobe released an emergency patch for the vulnerability, and organizations are urged to apply it immediately to mitigate risk. Magento's widespread use and history of critical vulnerabilities make this flaw particularly attractive to threat actors. Exploitation attempts have targeted over 130 hosts from multiple IP addresses within 48 hours of the PoC's publication. Web application firewalls, such as Akamai's Adaptive Security Engine, have been effective in mitigating some exploit attempts by default. The vulnerability's critical nature and active exploitation highlight the urgent need for patching and enhanced monitoring of Magento deployments.
Jun 29, 2026
Adobe issued security updates for multiple vulnerabilities in **Adobe Commerce**, Adobe Commerce B2B, and Magento Open Source, including `CVE-2026-71362`, which open-source reporting indicates is being actively exploited in the wild. The broader advisory also covers Adobe Campaign Classic, ColdFusion, Content Credentials tools and SDKs, and Lightroom Classic. The Commerce flaws are remotely exploitable and may enable arbitrary code execution, malicious script injection into web forms, disclosure of sensitive information, security-control bypasses, privileged access to restricted files, and temporary denial of service. NCSC Netherlands, Guyana CIRT, and bjCSIRT urged administrators to apply Adobe's updates immediately; NCSC reported no known public proof-of-concept or exploit code for the vulnerabilities it described.
Sep 12, 2026