# Mirasvit Full Page Cache Warmer deserialization flaw exploited

Published: 2026-06-03 · Severity: high
Canonical: https://vorant.io/reports/64bf1073-45e5-5cf2-a069-b9c88c1e0250/mirasvit-full-page-cache-warmer-deserialization-flaw-exploited

> CVE-2026-45247 in Mirasvit Full Page Cache Warmer allows remote code execution via unsafe deserialization and is actively exploited in the wild.

CISA has added CVE-2026-45247 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the field. The vulnerability is a deserialization of untrusted data flaw in Mirasvit Full Page Cache Warmer, a product commonly deployed in web environments. Deserialization attacks of this type are a well-established attack vector that allows attackers to achieve arbitrary code execution on affected systems.

Federal Civilian Executive Branch agencies are required by Binding Operational Directive 22-01 to remediate this vulnerability by the specified due date. CISA recommends all organizations, not just federal agencies, prioritize patching this vulnerability as part of their vulnerability management program. The catalog listing confirms this is not a theoretical risk but an active threat with documented exploitation.

## Mentioned in this report

- Vulnerabilities: CVE-2026-45247 (KEV)

## Detection guidance (public sample)

### Web Server or PHP Process Spawning Shell With Recon or Download-and-Execute Commands

ATT&CK: T1190

Detects a PHP or web server process on Linux spawning a shell that runs recon, download-and-execute or reverse-shell commands. This is a typical post-exploitation sign after deserialization RCE in a PHP e-commerce extension. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Server or PHP Process Spawning Shell With Recon or Download-and-Execute
  Commands
description: Detects php-fpm, php, Apache or nginx worker processes on Linux spawning
  a shell that runs recon, payload download or reverse-shell commands. Generalises
  post-exploitation after deserialization RCE in PHP web applications (e.g. Magento
  extensions such as Mirasvit Full Page Cache Warmer, CVE-2026-45247), not a specific
  payload.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1202
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /php-fpm
    - /php-fpm7
    - /php-fpm8
    - /php
    - /php7
    - /php8
    - /apache2
    - /httpd
    - /nginx
  selection_shell:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cmd:
    CommandLine|contains:
    - whoami
    - uname -a
    - /etc/passwd
    - curl
    - wget
    - base64 -d
    - /dev/tcp/
    - nc -e
    - bash -i
    - chmod +x
    - python -c
    - perl -e
  condition: selection_parent and selection_shell and selection_cmd
falsepositives:
- Web applications or admin plugins that legitimately shell out to curl or wget for
  health checks or cache warming
- Deployment scripts triggered through PHP that download packages
level: medium
id: 43227488-37d3-5639-b575-dfe177d00935
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/alerts/2026/06/03/cisa-adds-one-known-exploited-vulnerability-catalog
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/alerts/2026/06/03/cisa-adds-one-known-exploited-vulnerability-catalog

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/64bf1073-45e5-5cf2-a069-b9c88c1e0250/mirasvit-full-page-cache-warmer-deserialization-flaw-exploited.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup