CVE-2026-45247: Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability
Summary: CVE-2026-45247 is a deserialization of untrusted data vulnerability in Mirasvit Full Page Cache Warmer that could let unauthenticated attackers achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. CISA has added it to its Known Exploited Vulnerabilities catalog with a remediation due date of 2026-06-06, and known ransomware campaign use is listed as unknown.
What's compelling: The flaw requires no authentication and yields remote code execution, and CISA's June 6, 2026 due date puts the patch on a federal clock; whether ransomware crews are already using it is listed as unknown, not as no.
Read the original at CISA KEV Catalog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-45247Mirasvit
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026