CISA Flags Magento Cache Extension Bug as Actively Exploited

CISA added a critical bug in Mirasvit Cache Warmer — a widely deployed Magento full-page cache extension — to its Known Exploited Vulnerabilities catalog on Wednesday, citing active exploitation in the wild.

The flaw is tracked as CVE-2026-45247 and carries a CVSS score of 9.8. Root cause is deserialization of untrusted data, the same bug class that has burned PHP-based e-commerce stacks for years.

Successful exploitation yields remote code execution in the context of the Magento application. For storefronts, that's the worst-case scenario: skimmer injection, order data theft, and persistence in the checkout pipeline.

Attribution is thin so far. No vendor has publicly tied this round of exploitation to a named cluster, and the activity has the hallmarks of opportunistic financially motivated abuse rather than a state-aligned operation. That said, Magento and Adobe Commerce environments have been a recurring target for Magecart-style intrusion sets — loosely overlapping crews that researchers at RiskIQ (now Microsoft) historically broke out as Groups 1 through 12 based on infrastructure and skimmer code reuse. Whether any of those clusters are behind the current wave is, at best, medium-confidence speculation until skimmer artifacts surface.

The pattern is familiar. A vulnerable third-party extension extends the Magento attack surface well beyond what Adobe itself patches on its monthly cadence. CosmicSting (CVE-2024-34102) hit the core platform last year and was mass-exploited within weeks. Cache Warmer is a different code path but a similar story: deserialization sink, internet-exposed, high-value target.

Mirasvit's extension is bundled into a large number of Magento 2 deployments, often as a dependency of performance-tuning bundles rather than something merchants installed deliberately. That makes inventory the first problem to solve. Operators should audit composer.lock and app/code/Mirasvit/ for the presence and version of the Cache Warmer module before assuming they're out of scope.

Federal civilian agencies have until the KEV-assigned due date to patch or mitigate. Private-sector operators running Magento or Adobe Commerce should treat the timeline as equally urgent — KEV listings have historically tracked closely with broad commodity exploitation within days, not weeks.

Mitigation guidance from the vendor was not yet publicly indexed at time of writing. In the interim, defenders can look for anomalous POST traffic to cache-warmer endpoints, unexpected PHP processes spawned by the web user, and outbound connections from Magento hosts to infrastructure not previously seen in baselines.

Indicators tied to this specific campaign have not been published. Expect that to change once incident responders working active cases finish their write-ups.