Critical Mirasvit Cache Warmer RCE — Patch Your Magento Store Now
CVE-2026-45247 is a CVSS 9.8 remote code execution flaw in a popular Magento caching extension. It's on CISA's actively-exploited list. If you run Mirasvit Full Page Cache Warmer below 1.11.12, you're a target.
Actively exploited — CISA KEV, added 3 June 2026
CVSS 9.8, unauthenticated remote code execution. All Mirasvit Full Page Cache Warmer versions below 1.11.12 are affected. Patch released 25 May. Update or disable the extension today.
The short version
CVE-2026-45247 is a critical remote code execution vulnerability in the Mirasvit Full Page Cache Warmer — a widely used performance extension for Magento. It scores 9.8 out of 10 on the CVSS scale, the severity reserved for the most dangerous flaws.
The bug is a deserialization of untrusted data, which allows an unauthenticated attacker to execute arbitrary PHP code on your server. No login, no customer account, no admin access required — just a reachable store running the vulnerable extension. On 3 June 2026, CISA added it to the Known Exploited Vulnerabilities catalog, confirming it's being used in real attacks.
CVE-2026-45247 at a glance
Why this one is serious
Three factors stack up to make CVE-2026-45247 a genuine emergency rather than a routine update. First, it's unauthenticated — the attacker needs nothing from you, just network access to your store. Second, it leads to remote code execution, the worst outcome: once an attacker runs their own PHP, they can skim card data, inject malware, exfiltrate your database, or quietly establish persistence. Third, it's confirmed as actively exploited and on CISA's KEV list, which means automated scanning for vulnerable stores is already happening.
For a Magento store, RCE is the scenario that leads to Magecart-style card skimmers and the kind of breach that triggers PCI consequences and customer-notification obligations. This is not one to leave for next week's maintenance window.
What to do right now
Step 1 — Check whether you run the extension
Run 'bin/magento module:status' and look for the Mirasvit Cache Warmer module, or check composer.json for 'mirasvit/module-cache-warmer'. If it's present and below 1.11.12, you're affected.
Step 2 — Update to 1.11.12 or later
Mirasvit released the fix on 25 May 2026. Update via Composer ('composer update mirasvit/module-cache-warmer'), then run setup:upgrade, di:compile and cache:flush. Test on staging first if you can, but don't let testing delay a critical patch for long.
Step 3 — Can't patch immediately? Disable it
If you can't update straight away, disable the extension ('bin/magento module:disable Mirasvit_CacheWarmer') until you can. A temporarily slower cache warm-up is far better than an open RCE.
Step 4 — Check for signs of compromise
Because exploitation is active, assume you may have been probed. Review recent file changes, unexpected admin users, and unfamiliar cron jobs or PHP files in pub/ and var/. If anything looks wrong, engage your developer or host immediately.
Where managed hosting helps
Extension vulnerabilities are a fact of life on Magento — the platform's flexibility comes from third-party code, and third-party code carries third-party risk. You can't eliminate that, but the right hosting setup shortens the window between disclosure and protection.
Every EveryHost Magento store sits behind the Sentinel web application firewall, which helps block known exploit patterns at the edge while you patch, and we track CVEs added to CISA's KEV catalog so active threats like this one are on our radar quickly. To be clear: a WAF buys time, it doesn't replace patching. The only complete fix for CVE-2026-45247 is updating the extension to 1.11.12.
If you're an EveryHost customer and you're not sure whether your store runs the Mirasvit Cache Warmer, get in touch and we'll check and help you apply the update.
Further reading
Frequently asked questions
What is CVE-2026-45247?+
CVE-2026-45247 is a critical (CVSS 9.8) remote code execution vulnerability in the Mirasvit Full Page Cache Warmer extension for Magento. It is caused by deserialization of untrusted data, which lets an unauthenticated attacker execute arbitrary PHP code on the server. All versions of the extension below 1.11.12 are affected.
Is CVE-2026-45247 being exploited?+
Yes. CISA added CVE-2026-45247 to its Known Exploited Vulnerabilities (KEV) catalog on 3 June 2026 after confirming active exploitation in the wild, and set a 6 June 2026 remediation deadline for US federal agencies. Active exploitation plus an unauthenticated attack vector makes this an urgent patch for any affected store.
Which version of Mirasvit Cache Warmer fixes the flaw?+
Mirasvit released a patched version, 1.11.12, on 25 May 2026. Any store running the Full Page Cache Warmer extension below 1.11.12 should update to 1.11.12 or later immediately. If you cannot update right away, the safest interim step is to disable the extension until you can patch.
How do I know if my Magento store has the Mirasvit Cache Warmer extension?+
Check your installed modules with the command 'bin/magento module:status' and look for the Mirasvit Cache Warmer module, or inspect composer.json for a mirasvit/module-cache-warmer dependency. If it is present and below version 1.11.12, you are affected. If you are unsure, your hosting provider or developer can confirm quickly.
Does EveryHost protect against CVE-2026-45247?+
EveryHost runs the Sentinel web application firewall in front of every Magento store, which helps block known exploit patterns, and we monitor for active CVEs added to CISA KEV. However, no WAF is a substitute for patching — the only complete fix is updating the Mirasvit extension to 1.11.12 or later. EveryHost customers can ask our team to confirm whether the extension is present and assist with the update.
Magento hosting with a WAF in front and specialists behind it
Sentinel WAF, active CVE monitoring, and UK-based Magento engineers who help you patch fast. Built around the Adobe-recommended stack, free migration included.