CVE-2026-45247: mirasvit full page cache warmer

csirt@kutim:~/threat-intel/cve/CVE-2026-45247

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 2,1%

Kerentanan Deserialization of Untrusted Data pada mirasvit full page cache warmer. Skor CVSS 3.1 9.8 (Critical) menurut vulncheck.com. Masuk katalog KEV CISA pada 3 Juni 2026, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Attackers can exploit the unrestricted call to PHP's native unserialize() function combined with gadget chains available in Magento and its dependencies to execute arbitrary code on the server.

Rincian

Terbit di NVD: 26 Mei 2026
Terakhir diubah: 24 Juli 2026
Status NVD: Analyzed
CVSS 3.1: 9.8 (Critical), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-502: Deserialization of Untrusted Data
EPSS (30 hari): 2,1% peluang dieksploitasi; lebih tinggi dari 81,0% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability
Masuk KEV: 3 Juni 2026
Tenggat CISA: 6 Juni 2026 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
mirasvit	full page cache warmer	Semua versi sebelum 1.11.12

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45247 pemerintah AS
https://sansec.io/research/mirasvit-cache-warmer-object-injection advisory pihak ketiga
https://www.vulncheck.com/advisories/mirasvit-cache-warmer-for-magento-php-object-injection advisory pihak ketiga
https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-45247-in-mirasvit-full-page-cache-wa... advisory pihak ketiga
https://mirasvit.com/package/changelog/?package=mirasvit/module-cache-warmer release notes

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.