CISA Adds Exploited Magento RCE Flaw CVE-2026-45247 to KEV Catalog
CISA adds critical Magento RCE flaw CVE-2026-45247 to KEV catalog after active exploitation.
CISA has added CVE-2026-45247, a critical remote code execution vulnerability in Mirasvit Cache Warmer (a Magento extension), to its Known Exploited Vulnerabilities catalog following confirmed active exploitation. The flaw is a PHP object deserialization vulnerability (CVSS 9.8) affecting all versions prior to 1.11.12 that allows unauthenticated attackers to execute arbitrary code via a crafted CacheWarmer cookie. Imperva has observed active attack campaigns primarily targeting gaming and business sites in the U.S., UK, France, and Australia, with FCEB agencies ordered to patch by June 6, 2026.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Mirasvit?
Get an email when a new story names Mirasvit, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical PHP object deserialization vulnerability (CVE-2026-45247) in the Mirasvit Cache Warmer extension for Magento allows unauthenticated attackers to execute arbitrary code through a crafted cookie. This supply chain vulnerability affects all versions prior to 1.11.12 and demonstrates how third-party extensions can introduce severe security risks to e-commerce platforms. The active exploitation campaigns targeting gaming and business sites highlight the urgent need for comprehensive patch management and supply chain security practices. Organizations must treat third-party components with the same security rigor as their core systems to prevent such critical exposures.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Web application firewall and DDoS protection
Websites and APIs stay up, and common web attacks are filtered before they reach them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-45247