Mirasvit Full Page Cache Warmer RCE (CVE-2026-45247)

Historical catalog analysis: CISA added this entry on June 03, 2026. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-45247 is a deserialization of untrusted data vulnerability (CWE-502) affecting the Mirasvit Full Page Cache Warmer product. The flaw allows an unauthenticated attacker to achieve remote code execution (RCE) by submitting a crafted serialized PHP object within the CacheWarmer cookie.

Exposure and applicability

This vulnerability applies to environments utilizing the Mirasvit Full Page Cache Warmer module. Because the attack vector is an HTTP cookie, the exposure path is direct and does not require prior authentication, making any internet-facing instance of the affected product a potential target for RCE.

Remediation priorities

Based on the reported risk, we analyze the following prioritization for vulnerability management teams:

1. Immediate Patching: Prioritize applying vendor-supplied mitigations as detailed in the Mirasvit changelog. This is the primary method to address the root cause of the deserialization flaw.
2. Cloud Service Alignment: For organizations utilizing cloud services, we recommend aligning remediation timelines with BOD 22-01 guidance where applicable to ensure consistent exposure reduction across hybrid environments.
3. Product Decommissioning: In scenarios where vendor mitigations cannot be applied or are unavailable for the specific deployment version, the most effective risk reduction is to discontinue use of the product entirely.

How to validate remediation

Verification must go beyond a simple version check, as a deployed update does not always guarantee that the configuration is secure or that the patch was successfully initialized. To verify that exposure has been reduced, defenders should:

• Confirm Mitigation Application: Cross-reference the installed version against the vendor’s specific fixed-version documentation.
• Verify Input Handling: Ensure that the CacheWarmer cookie is no longer processed via unsafe deserialization methods as specified in the vendor’s technical guidance.

Limits and open questions

It remains unknown whether this vulnerability has been leveraged in known ransomware campaigns. Additionally, while patching reduces the likelihood of exploitation, residual risk may persist if other components of the PHP environment allow for similar deserialization patterns. Defenders should note that CISA-mandated deadlines apply specifically to federal agencies; non-federal entities must determine their own priority based on their specific threat profile.

Source and editorial note

CVE-2026-45247: Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability · Source date: June 03, 2026 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: June 06, 2026. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 09, 2026 at 02:00 UTC.

Request a Vulnerability Assessment