Mirasvit

Mirasvit came to international attention in June 2026 when its Full Page Cache Warmer extension for Magento 2 and Adobe Commerce was found to contain CVE-2026-45247, a CVSS 9.8 unauthenticated Remote Code Execution flaw. The vulnerability, caused by unsafe PHP deserialisation of a crafted cookie value, was patched on 25 May 2026 and listed on CISA's Known Exploited Vulnerabilities catalogue by 3 June — a nine-day window in which Sansec and Imperva confirmed active attacks against retail and gaming sites in the US, UK, France and Australia.

Mirasvit is a Ukrainian software house specialising in Magento extensions across performance, search and merchandising functions. Its Cache Warmer product pre-generates cached page versions to improve storefront load times, making it a common install across performance-conscious e-commerce operators. The vulnerability sits in the extension's handling of the CacheWarmer cookie, where attacker-controlled serialised PHP objects can trigger arbitrary code execution on the server without authentication.

The CVE-2026-45247 incident illustrates the structural security gap in Magento's third-party extension ecosystem: extensions are not subject to the same mandatory security-review gate as the core platform, meaning high-CVSS flaws in widely-deployed ADD-ons can reach thousands of production stores before any audit catches them. Adobe's Marketplace review process checks compatibility and code quality rather than exploitable deserialisation patterns, leaving extension vendors as independent security actors whose patch cadence directly determines how fast exposure spreads across the global Magento install base.