CVE‑2026‑45247: Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Leads to Remote Code Execution
What It Is – The Mirasvit Full Page Cache Warmer Magento extension contains a deserialization flaw. An attacker can embed a malicious PHP object in the CacheWarmer cookie, which the extension unserializes without validation.
Exploitability – The vulnerability is exploitable remotely without authentication. Public proof‑of‑concept code has been observed, and the CVSS score assigned by NVD is 8.8 (High).
Affected Products – Mirasvit Full Page Cache Warmer (all versions prior to the vendor’s pending patch).
Why It Matters for Trust & Control Assurance
- Vulnerability Management – Demonstrates the need for continuous monitoring of third‑party components and timely patching to satisfy the “secure development and vulnerability remediation” control objective.
- Evidence of Due Diligence – Maintaining an auditable inventory of external libraries and proof of remediation provides defensible evidence for frameworks such as NIST CSF 2.0.
- Enterprise Buyer Expectations – Large buyers increasingly request proof that vendors have robust processes for identifying and mitigating supply‑chain code flaws before they become exploitable.
Recommended Actions
- Identify any instances of the Mirasvit Full Page Cache Warmer in your environment using asset‑inventory tools.
- Apply the vendor‑released patch immediately; if unavailable, block the
CacheWarmercookie via a web‑application firewall rule. - Document the remediation step in your vulnerability‑management system to create audit‑ready evidence of control execution.
- Integrate continuous monitoring of third‑party extensions into your secure‑development lifecycle to catch similar issues early.
Source: CISA KEV – CVE‑2026‑45247