Critical Magento Extension Vulnerability Enables Remote Code Execution

A critical PHP object deserialization vulnerability (CVE-2026-45247) in the Mirasvit Cache Warmer extension for Magento allows unauthenticated attackers to execute arbitrary code through a crafted cookie. This supply chain vulnerability affects all versions prior to 1.11.12 and demonstrates how third-party extensions can introduce severe security risks to e-commerce platforms. The active exploitation campaigns targeting gaming and business sites highlight the urgent need for comprehensive patch management and supply chain security practices. Organizations must treat third-party components with the same security rigor as their core systems to prevent such critical exposures.

Tactical Insight

Immediate actions

Update Mirasvit Cache Warmer extension to version 1.11.12 or later immediately
Scan all Magento instances for indicators of compromise related to this vulnerability
Review and inventory all installed Magento extensions for security updates

Long-term improvements

Implement automated vulnerability scanning for all third-party extensions and plugins
Establish a vendor security assessment process before installing new extensions
Create emergency patching procedures specifically for critical third-party components

Detection measures

Monitor web application logs for suspicious CacheWarmer cookie activity
Deploy web application firewalls with rules to detect object deserialization attacks