CISA KEV 03 Jun 2026: 1 exploited flaw in Mirasvit

Conceptual illustration: Glass website pages and plug-in blocks with one fractured connector receiving a patch. Headline: WEB APP SECURITY.

AI-generated illustration by CyberShitty. Not a photograph or a document from the organisations named.

On 3 June 2026, CISA added 1 actively exploited vulnerability affecting Mirasvit to its Known Exploited Vulnerabilities catalog. If you run any of these products, patch or mitigate now — exploitation is already happening.

CVE-2026-45247Federal deadline 06 Jun 2026

Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability

Mirasvit / Mirasvit Full Page Cache Warmer / CWE-502

Mirasvit Full Page Cache Warmer contains a deserialization of untrusted data vulnerability that could allow unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie.

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

mirasvit.com · nvd.nist.gov

In this section

Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability