Loading vulnerability…
CVE-2026-45247 is a PHP object injection / insecure deserialization vulnerability in Mirasvit Full Page Cache Warmer for Magento 2 affecting versions before 1.11.12. The extension processes attacker-controlled data from the CacheWarmer cookie and passes it to PHP's native unserialize() function without adequate restrictions. Because the cookie is client-controlled and the vulnerable code path is reachable on normal storefront requests, an unauthenticated attacker can supply a crafted serialized PHP object. By leveraging gadget chains present in Magento and its dependencies, the attacker can turn the unsafe deserialization into arbitrary code execution on the server.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a small standalone exploit PoC for an alleged unauthenticated PHP object injection vulnerability, identified as CVE-2026-45247, in the Mirasvit Full Page Cache Warmer extension for Magento 2 / Adobe Commerce. The repo has 4 files: an MIT license, a Python exploit script, a README describing the issue and usage, and a Bash verification script. The main exploit file is the Python script "PoC Funcional - CVE-2026-45247 (Mirasvit Full Page Cache Warmer RCE)". It uses the requests library to send HTTP GET requests to a user-supplied target URL. Its workflow is: (1) perform lightweight reconnaissance by probing Magento-related paths (/magento_version, /pub/static/version.php, /static/version.php) and the Mirasvit changelog path (/pub/media/mirasvit/cache_warmer/CHANGELOG.md); (2) build a malicious CacheWarmer cookie containing a base64-encoded serialized PHP object; and (3) send a GET request to the target root path with that cookie set. The exploit claims to leverage Monolog gadget chains and includes helper methods for multiple serialized payload variants, though only the FingersCrossedHandler/StreamHandler-based cookie builder is actually used in the exploit path. The exploit capability is remote command execution: the operator provides an arbitrary shell command, which is inserted into a php://filter/write=exec|<command> string inside the serialized object. The script then attempts to confirm success by searching the HTTP response body for markers such as "uid=" or "PWNED". This is a direct exploitation PoC rather than only a detector. The Bash script "Script de Verificación Rápida" is a separate detection helper. It checks whether /pub/media/mirasvit/cache_warmer/CHANGELOG.md is accessible and tries to parse a version string to determine whether the installed extension is older than 1.11.12. It does not exploit the target. Notable fingerprintable artifacts include the CacheWarmer cookie name, the Magento/Mirasvit probe paths, and the php://filter/write=exec|... stream wrapper embedded in the serialized payload. No hardcoded victim IPs or domains are present; the target is fully operator-supplied. Overall, the repository is a compact operational PoC for web-based unauthenticated RCE against a vulnerable Magento extension, accompanied by documentation and a simple reconnaissance/version-check script.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
91 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical unauthenticated remote code execution vulnerability in the Mirasvit Full Page Cache Warmer extension for Magento/Adobe Commerce. It is significant because CISA added it to KEV after active exploitation, and exploitation can give attackers arbitrary code execution and potentially full administrative control over production e-commerce servers.
A critical PHP object injection/deserialization of untrusted data vulnerability in Mirasvit Full Page Cache Warmer for Magento 2 that allows unauthenticated remote code execution via a crafted CacheWarmer cookie processed by PHP unserialize().
A critical unauthenticated remote code execution vulnerability in the Mirasvit Full Page Cache Warmer extension for Magento caused by insecure deserialization of untrusted data via the CacheWarmer cookie.
A critical unauthenticated remote code execution vulnerability in the Mirasvit Cache Warmer Magento full-page cache extension caused by deserialization of untrusted data / PHP object injection via the CacheWarmer cookie.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.