CISA Adds Exploited Magento RCE Flaw CVE-2026-45247 to KEV Catalog

Summary: CISA added CVE-2026-45247, a deserialization flaw with a CVSS score of 9.8 in the Mirasvit Cache Warmer Magento extension, to its KEV catalog on Wednesday after reports of active exploitation. The bug lets unauthenticated attackers send a crafted CacheWarmer cookie that PHP's unserialize() function processes, and it affects all versions before 1.11.12, which was patched on May 25, 2026.
Why it matters: Sansec counted about 6,000 stores running Mirasvit extensions, likely an undercount because Cloudflare and other CDNs mask installs, and Imperva has already seen payloads invoking system() and current() against gaming and business sites in the U.S., U.K., France, and Australia. FCEB agencies have until June 6, 2026 to patch, and a CacheWarmer cookie value matching CacheWarmer:(Tz|Qz|YT) is the indicator to hunt for.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-45247
Related: CVE-2026-45247: Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability Known Exploited Vulnerabilities · Jun 03, 2026
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026