Skip to content
feed: live
0dayNews
CVE Record
[ CRITICAL ]CVE-2026-45247

Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability

Mirasvit Full Page Cache Warmer contains a deserialization of untrusted data vulnerability that could allow unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie.

cat cve-2026-45247.json
Vendor
Mirasvit
Product
Mirasvit Full Page Cache Warmer
CVSS
9.8
EPSS (exploit probability)
26.2%
Status
kev
CISA patch-by (BOD 22-01)
Added to KEV
Source
https://nvd.nist.gov/vuln/detail/CVE-2026-45247

Is CVE-2026-45247 being exploited?

Yes. CISA added CVE-2026-45247 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.

FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 26.2% (scored October 25, 2026).

Catalog snapshot 2026-10-25. Full cross-catalog view: /kev-comparison

CVE-2026-45247 timeline

  1. Published to NVD
  2. Added to CISA KEV+8d

Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON

What to do

CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

US federal civilian agencies must remediate by (3 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.