CISA Flags Magento Cache Extension Bug as Actively Exploited

Key points

• CISA added CVE-2026-45247 to its Known Exploited Vulnerabilities catalog on Wednesday after confirmed in-the-wild exploitation.
• The flaw is a deserialization of untrusted data bug in Mirasvit Cache Warmer, a popular Magento full-page cache extension, and carries a CVSS score of 9.8.
• Successful exploitation allows remote code execution inside the Magento application.
• No vendor has publicly tied current exploitation to a named threat cluster; the activity looks opportunistic rather than state-aligned.
• Operators should audit composer.lock and app/code/Mirasvit/ to confirm whether and which version of Cache Warmer is deployed before assuming they are out of scope.

What does CVE-2026-45247 actually let an attacker do?

Successful exploitation yields remote code execution in the context of the Magento application. For storefronts that is the worst-case outcome: skimmer injection, order data theft, persistence inside the checkout pipeline. Deserialization of untrusted data is the bug class; attackers send a crafted payload to a cache-warmer endpoint, PHP processes it, and the application hands over control.

Who is behind the current exploitation wave?

Attribution is thin. No vendor has publicly tied this round of exploitation to a named cluster, and the activity has the hallmarks of opportunistic, financially motivated abuse rather than a state-aligned operation. Magento and Adobe Commerce environments have been a recurring target for Magecart-style intrusion sets, loosely overlapping crews that researchers at RiskIQ (now Microsoft) historically broke out as Groups 1 through 12 based on infrastructure and skimmer code reuse. Whether any of those clusters are behind the current wave is, at best, medium-confidence speculation until skimmer artifacts surface.

Should you worry if you run a third-party Magento extension?

Yes, and the pattern is familiar. A vulnerable third-party extension extends the Magento attack surface well beyond what Adobe itself patches on its monthly cadence. Cache Warmer is a deserialization sink, internet-exposed, sitting inside high-value storefronts. Mirasvit's extension is bundled into a large number of Magento 2 deployments, often as a dependency of performance-tuning bundles rather than something merchants installed deliberately. That makes inventory the first problem: audit composer.lock and app/code/Mirasvit/ before assuming you are out of scope. We covered a deserialization flaw in a similarly positioned Microsoft product on 28 May, where the same low-precondition exploitation model played out within days of the KEV listing.

What should defenders do right now?

Federal civilian agencies have until the KEV-assigned due date to patch or mitigate. Private-sector operators should treat that timeline as equally urgent: KEV listings have historically tracked closely with broad commodity exploitation within days, not weeks. Vendor mitigation guidance was not publicly indexed at time of writing. In the interim, look for anomalous POST traffic to cache-warmer endpoints, unexpected PHP processes spawned by the web user, and outbound connections from Magento hosts to infrastructure not previously baselined. Indicators tied to this specific campaign have not been published; expect that to change once incident responders finish their write-ups.

Common questions

What is the Known Exploited Vulnerabilities catalog?

CISA's Known Exploited Vulnerabilities catalog is a public list of security flaws confirmed to have been exploited in the wild. Federal civilian agencies are legally required to remediate listed vulnerabilities by the assigned deadline.

What is deserialization of untrusted data?

Deserialization converts stored or transmitted data back into an object a program can use. When an application does this without validating the data first, an attacker can craft a malicious payload that the application unpacks and executes as code.

Where is CVE-2026-45247 tracked?

The vulnerability is listed at NVD with a CVSS score of 9.8.