# CISA Marks Magento RCE as Actively Exploited: Patch the Cache Warmer Plugin Now
## The Threat
A critical remote code execution vulnerability in Mirasvit's popular Magento cache extension has moved from theoretical to weaponized. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-45247 to its Known Exploited Vulnerabilities (KEV) catalog on June 4, 2026, following confirmed active exploitation in the wild. The flaw impacts Mirasvit Full Page Cache Warmer, a ubiquitous Magento extension used by thousands of e-commerce sites globally.
The vulnerability stems from unsafe deserialization of untrusted data embedded in HTTP cookies. Specifically, the extension processes a CacheWarmer cookie value using PHP's native unserialize() function without proper validation or authentication checks. An attacker can craft a malicious serialized PHP object, encode it in Base64, and inject it into a cookie. When the vulnerable extension deserializes this payload, it reconstructs arbitrary PHP objects that attackers can chain together—exploiting gadget chains from Magento and its dependencies—to achieve full remote code execution on the compromised server.
What makes this particularly dangerous is the low barrier to exploitation. Unlike many critical flaws that require authentication or complex setup, CVE-2026-45247 can be triggered by any unauthenticated visitor simply by sending a malicious HTTP request. Security researchers at Sansec and Imperva have already documented active exploitation campaigns targeting the vulnerability, with attackers using test commands to validate successful code execution before deploying more sophisticated payloads.
## Severity and Impact
| Field | Details |
|-------|---------|
| CVE ID | CVE-2026-45247 |
| CVSS Score | 9.8 (Critical) |
| Attack Vector | Network |
| Attack Complexity | Low |
| Authentication | None Required |
| User Interaction | None |
| Affected Component | Mirasvit Full Page Cache Warmer |
| CWE | CWE-502 (Deserialization of Untrusted Data) |
| Exploit Status | Active in the Wild |
## Affected Products
- Patch released: May 25, 2026
- Current patched version: 1.11.12 and later
The vulnerability has been identified on approximately 6,000 known Magento storefronts, though actual numbers are likely significantly higher given that CDN masking (via services like Cloudflare) obscures true install counts across the Magento ecosystem.
## Mitigations
Immediate Actions:
1. Update to Version 1.11.12 or Later — This is the primary remediation. Administrators should apply the patch immediately, particularly given the active exploitation activity. Federal Civilian Executive Branch (FCEB) agencies have been mandated to patch by June 6, 2026; all other organizations should treat this as an emergency.
2. Detection and Monitoring — Organizations unable to patch immediately should monitor for exploitation attempts. Inspect HTTP logs for CacheWarmer cookies containing Base64-encoded serialized objects. Sansec provides a reliable detection pattern:
- Look for cookie entries matching: CacheWarmer:(Tz|Qz|YT).*
- Serialized PHP objects, when Base64-encoded, begin with Tz, Qz, or YT
- Any matching requests should be logged and investigated
3. Web Application Firewall (WAF) Rules — Deploy WAF rules to block requests containing suspicious CacheWarmer cookie values. Imperva and other security vendors have published signatures for detecting malicious payloads.
4. Network Segmentation — Isolate affected Magento instances from internal networks where possible. Restrict database access credentials and ensure that any RCE on a web server cannot lateral-move to backend systems.
5. Disable the Extension (Temporary Workaround) — If patching cannot be completed immediately and the Cache Warmer functionality is not critical, organizations can temporarily disable the extension to eliminate the attack surface.
6. Audit Access Logs — Review web server and application logs dating back at least two weeks for evidence of exploitation attempts. Look for unusual command execution patterns or suspicious process spawning.
## References
## HackWire Analysis
PHP object injection through unsanitized deserialization has haunted web applications for over a decade, yet it persists as a vector for high-impact attacks. CVE-2026-45247 exemplifies a pattern that defenders should recognize: popular open-source extensions become force multipliers for attackers because a single vulnerability in a widely-installed package impacts thousands of sites simultaneously.
The Mirasvit case is particularly instructive because the attack surface is deceptively minimal—the malicious payload rides in a cookie, no authentication required. This mirrors other recent extension vulnerabilities where legitimate functionality (caching optimization, in this case) creates an implicit trust boundary that developers fail to properly protect. The addition of this flaw to CISA's KEV catalog signals that exploit code is circulating and being actively deployed. Based on Imperva's telemetry showing attacks concentrated on gaming and business sites in the US, UK, France, and Australia, it's reasonable to assume that attackers are using this as a reconnaissance and initial access vector—likely as a precursor to higher-stakes attacks like payment card theft or lateral movement.
For Magento administrators, the patch timeline (May 25 → June 6 deadline for federal agencies) is unambiguous: this is a days-to-patch situation, not weeks. For security operations teams, the detection signatures are well-documented enough that you can implement monitoring today even if patching is delayed. The concerning element is what comes next—once attackers confirm RCE on a vulnerable store, the next steps (data exfiltration, backdoor installation, supply chain pivots) happen rapidly. Organizations that have not yet applied the 1.11.12 update are operating under active threat.
— HackWire Editorial
## Related Coverage