Mirasvit Full Page Cache Warmer RCE Active Exploitation (CVE-2026-45247) | MSSP Advisory

Risk Assessment

CISA added CVE-2026-45247 to its Known Exploited Vulnerabilities catalog on June 3, a CVSS 9.8 flaw in the Mirasvit Full Page Cache Warmer extension for Magento and Adobe Commerce. The vulnerability requires no authentication and allows remote code execution by injecting malicious base64 encoded payloads into the CacheWarmer HTTP cookie, giving attackers full administrative control over the affected server. Sansec first reported active exploitation on May 26, and CISA set a federal remediation deadline of June 6.

If you manage any e-commerce clients running Magento or Adobe Commerce, you need to know right now whether Mirasvit Cache Warmer is installed in their environment, because an unauthenticated attacker can already be executing code and skimming payment credentials without triggering a login event. Your own stack exposure is lower here unless you use Magento internally, but your advisory obligation is immediate and direct because 20 percent of U.S. retailers run this platform and your clients almost certainly include merchants. Silence on this one is a contract problem waiting to happen.