Answer in brief
CVE-2026-45247 records a High severity vulnerability in Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection. The current sources mark it as known exploited. The current feed maps Mirasvit/Full Page Cache Warmer for Magento 2 (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. Known-exploitation status makes exposure review time-sensitive. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Mirasvit/Full Page Cache Warmer for Magento 2 (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Mirasvit/Full Page Cache Warmer for Magento 2generic | >=0 <1.11.12 | 1.11.12 |
Published upstream
May 26, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jun 6, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 3, 2026
Added to CISA KEV
Jun 3, 2026
Evidence: source:kev:kev:kev:recordMirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Attackers can exploit the unrestricted call to PHP's native unserialize() function combined with gadget chains available in Magento and its dependencies to execute arbitrary code on the server.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-45247 records a High severity vulnerability in Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection. The current sources mark it as known exploited. The current feed maps Mirasvit/Full Page Cache Warmer for Magento 2 (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. Known-exploitation status makes exposure review time-sensitive. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Mirasvit/Full Page Cache Warmer for Magento 2 (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Mirasvit/Full Page Cache Warmer for Magento 2generic | >=0 <1.11.12 | 1.11.12 |
Published upstream
May 26, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jun 6, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 3, 2026
Added to CISA KEV
Jun 3, 2026
Evidence: source:kev:kev:kev:recordMirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Attackers can exploit the unrestricted call to PHP's native unserialize() function combined with gadget chains available in Magento and its dependencies to execute arbitrary code on the server.
Quoted source text, attributed separately from HOL analysis.