The Mirasvit Full Page Cache Warmer extension for Magento 2 contains a PHP object injection vulnerability (CVE-2026-45247) that allows unauthenticated attackers to remotely execute code on Magento and Adobe Commerce servers. This occurs because the extension deserializes user-supplied serialized PHP objects from the CacheWarmer cookie without restricting allowable classes, enabling exploitation via gadget chains in Magento's codebase. The vulnerability has a CVSS score of 9.8 and has been actively exploited in the wild since its public disclosure on May 26, 2026. The US CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog and mandates patching within three days for federal agencies. The vendor released version 1.11.12 to address the issue. Detection can be aided by monitoring for CacheWarmer cookies containing base64-encoded serialized objects starting with Tz, Qz, or YT.

Successful exploitation leads to remote code execution on Magento and Adobe Commerce servers running vulnerable versions of the Mirasvit Cache Warmer extension. This can allow attackers to execute arbitrary code without authentication, potentially compromising the entire server and associated data. The vulnerability has been actively exploited in the wild, increasing the risk to affected organizations. Thousands of Magento stores are potentially exposed if not updated to the patched version.

A patch is available in Mirasvit Cache Warmer extension version 1.11.12 and later. Organizations should immediately update to this version to remediate the vulnerability. CISA mandates federal agencies to patch within three days. Administrators can monitor for exploitation attempts by checking for CacheWarmer cookies containing base64-encoded serialized PHP objects starting with Tz, Qz, or YT as indicators of compromise. No other vendor advisories indicate alternative mitigations or that no action is required.