CVE-2026-45247 is a critical vulnerability in Mirasvit Full Page Cache Warmer for Magento 2 prior to version 1.11.12. It involves deserialization of untrusted data through the CacheWarmer cookie, enabling unauthenticated remote code execution. The root cause is the unrestricted call to PHP's unserialize() function on attacker-controlled input, which can be exploited using existing gadget chains in Magento and related libraries to execute arbitrary code on the server.

Successful exploitation allows unauthenticated attackers to achieve remote code execution on the affected server, potentially leading to full system compromise. This poses a severe risk to the confidentiality, integrity, and availability of the affected Magento 2 installations using the vulnerable Full Page Cache Warmer extension.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling the Full Page Cache Warmer extension or blocking requests that include the CacheWarmer cookie from untrusted sources to reduce exposure.