Critical Analysis: CVE-2026-45247 - Mirasvit Full Page Cache Warmer Deserialization of Untrusted... — June 6, 2026

Published 06 Jun 2026 · vulnerability management, CVE analysis, threat intelligence, security operations, cybersecurity news

Initial Discovery and Context Good to sit down and talk about this one. We're looking at CVE-2026-45247, a critical deserialization vulnerability impacting the Mirasvit Full Page Cache Warmer extension for Magento. This one dropped on June 6, 2026, and it’s a pretty nasty piece of work, scoring a solid 9.8 CVSSv3.1, largely due to its network-adjacent exploitability and high impact on confidentiality, integrity, and availability, without requiring user interaction or elevated privileges. When we talk about e-commerce platforms, especially one as pervasive as Magento, a vulnerability like this in a widely used extension like Mirasvit's Cache Warmer immediately raises alarms. These extensions often operate with elevated privileges within the Magento environment, interacting directly with core functionalities and, critically, the underlying PHP runtime. The specific versions affected by thi