CVE-2026-45247 — Mirasvit Full Page Cache Warmer (Magento / Adobe Commerce) Unauthenticated RCE

What it is. CVE-2026-45247 is a critical (CVSS 9.8) unauthenticated remote-code-execution flaw in the Mirasvit "Full Page Cache Warmer" extension for Magento 2 / Adobe Commerce. The extension reads the attacker-controlled CacheWarmer HTTP cookie and passes it straight to PHP unserialize() with no allow-list on which classes may be instantiated. An attacker supplies a base64-encoded, crafted serialized PHP object; deserialization triggers magic methods (__destruct / __wakeup) that drive a Monolog gadget chain into system() / current(), yielding code execution as the web-server user.

Why it matters. A single crafted cookie on any storefront page is enough — no login, no admin path, fires on ordinary traffic. CISA added it to the KEV catalog on 2026-06-03 (FCEB remediation deadline 2026-06-06) on evidence of active exploitation. Imperva observed in-the-wild payloads running validation commands such as echo PWNED_CVE2026_$(date +%s) and sleep 5 before staging further tooling. The natural follow-on for a compromised Magento host is a web shell under pub/ or media/, a Magecart payment skimmer injected into checkout/CMS content, a rogue admin user, and persistence via cron or modified application files.

Defensive angle. The exploit is a cookie, so the loudest, highest-fidelity Falcon signal is behavioral on the web host: the PHP / web-server process tree (php-fpm, httpd, nginx, apache2) spawning shells or recon binaries, and executable / PHP file writes under public web roots. Those are the hunts in this pack. The cookie signature CacheWarmer=(Tz|Qz|YT)... is best matched at the WAF / reverse-proxy / access-log layer (Section 7) and forwarded to Falcon NGSIEM.

Defender priority: On every internet-facing Magento/Adobe Commerce host running Falcon, hunt php-fpm/httpd/nginx/apache2 spawning sh, bash, id, whoami, curl, wget, python (Q1) and new .php / executable writes under pub/ or media/ (Q3) right now. These two fire on the post-exploitation step regardless of how the cookie was crafted. Patch to 1.11.12 or disable the extension to remove the attack path.

Hunter note: No atomic IOCs (attacker IPs, webshell hashes, skimmer domains) are published yet — attribution is unknown and reported goal is reconnaissance. This pack therefore leans on behavioral detections plus the cookie signature. The base64 cookie prefixes decode to PHP serialization markers: Tz → O: (object), Qz → C: (custom/serializable object), YT → a: (array) — the presence of any of these in a CacheWarmer cookie indicates a serialized payload, which the extension never legitimately receives from a browser.

Hunt hypotheses (ordered by fidelity)

1. H1 (high): A web-server/PHP process (php-fpm, httpd, apache2, nginx) on a Magento host spawned a shell or recon binary (sh, bash, id, whoami, uname) — the direct footprint of gadget-chain command execution. Covers T1190 → T1059.
2. H2 (high): The validation marker string PWNED_CVE2026 appears in a command line on the web host — Imperva's observed canary. Covers T1190 / T1059.004.
3. H3 (high): A new .php or executable file was written under a public web root (pub/, media/, pub/static/) by the web-server user — webshell drop. Covers T1505.003.
4. H4 (medium): The web-server/PHP process made an outbound network connection to an external host shortly after a write or shell event — tooling pull / C2 / skimmer beacon. Covers T1071 / T1105.
5. H5 (medium): A reverse-shell command line (bash -i, /dev/tcp/, nc -e, python -c socket) is observed on the web host. Covers T1059.004 / T1571.
6. H6 (medium): The web-server user registered a cron job or modified persistence files (crontab, /etc/cron.*). Covers T1053.003.
7. H7 (medium): The cookie signature CacheWarmer=(Tz|Qz|YT) appears in forwarded access/WAF logs — exploitation attempt, pre-impact. Covers T1190 (native-log hunt, Section 7).
8. H8 (low): New Magento admin user creation or app/etc/env.php / payment-config modification correlated to the web host — rogue admin / skimmer staging. Covers T1136 / T1505 (app-log hunt).

Attack chain

No atomic IOCs published. No attacker IPs, webshell hashes, or skimmer domains are public as of 2026-06-15. The indicators below are behavioral / signature-based. Treat published values as starting points and validate in-tenant.

The exploit primitive is an HTTP cookie that never reaches the EDR process layer. These checks run at the web / app tier and feed Falcon NGSIEM where forwarded.

1 · WAF / reverse-proxy / Magento access logs — cookie signature

Search HTTP request logs for a CacheWarmer cookie whose value begins with a PHP serialization marker. Any match is high-fidelity — browsers never send serialized objects in this cookie.

grep -E 'CacheWarmer=(Tz|Qz|YT)' /var/log/nginx/access.log /var/log/apache2/access.log
# decode + confirm: base64 -d after the cookie value should reveal O: / C: / a: serialized PHP
# also flag overly long CacheWarmer cookie values (> 200 chars) regardless of prefix

2 · php-fpm / web-server error logs — gadget classes

grep -E 'Monolog\\(Handler\\)?(SyslogUdpHandler|BufferHandler|FingersCrossedHandler|GroupHandler)' \
  /var/log/php*-fpm.log /var/log/php_errors.log
# unserialize() of these handler classes outside legitimate logging = gadget-chain attempt

3 · Magento admin audit — rogue accounts & config tamper

• Admin → System → Permissions → All Users: review for unexpected accounts created on/after 2026-05-25.
• SELECT username, created, logdate FROM admin_user ORDER BY created DESC; — flag entries not in your change record.
• Diff app/etc/env.php, payment-method config, and CMS blocks/pages against a known-good backup for injected JS or altered crypt key.

4 · Storefront client-side — Magecart skimmer

• Compare checkout / CMS page JavaScript against baseline; look for unfamiliar external script src or inline form-field listeners.
• If CSP is deployed, review report-uri violations for new script origins.

// HUNT: Web/PHP process spawns shell or recon binary (CVE-2026-45247 post-exploit)
// MITRE: T1190, T1059.004, T1082, T1033
// CONF: high  FP: low  COST: low | REQUIRES: Linux ProcessRollup2
// FALSE POSITIVES: deploy/build tooling, site cron via php-cli
// TUNING: restrict aid to Magento web hosts; exclude CI/deploy service accounts
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/ event_platform=Lin
| ParentBaseFileName=/^(php-fpm|httpd|apache2|nginx|php)/i
| ImageFileName=/\/(sh|bash|dash|id|whoami|uname|hostname|cat|curl|wget|python[23]?|perl)$/i
| table([@timestamp, ComputerName, aid, ParentBaseFileName, ImageFileName, CommandLine, UserName], limit=200)

// HUNT: CVE-2026-45247 exploitation validation canary (PWNED marker / sleep test)
// MITRE: T1190, T1059.004
// CONF: high  FP: low  COST: low | REQUIRES: Linux ProcessRollup2
// FALSE POSITIVES: benign scripts using sleep (mitigated by web-parent gate)
// TUNING: PWNED_CVE2026 needs no tuning; drop the sleep alternation if noisy
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/ event_platform=Lin
| ParentBaseFileName=/^(php-fpm|httpd|apache2|nginx|php)/i
| CommandLine=/PWNED_CVE2026|\bsleep\s+\d+\b/i
| table([@timestamp, ComputerName, aid, ParentBaseFileName, ImageFileName, CommandLine, UserName], limit=200)

// HUNT: New PHP/executable written under Magento public web root (webshell)
// MITRE: T1505.003
// CONF: high  FP: medium  COST: low | REQUIRES: Linux FileCreateInfo (file telemetry)
// FALSE POSITIVES: setup:static-content:deploy writing under pub/static
// TUNING: exclude /pub/static/ paths and CI deploy accounts; PHP under media/ is never legitimate
#event_simpleName=/NewExecutableWritten|PeFileWritten/ event_platform=Lin
| TargetFileName=/\/(pub|media)\/.*\.(php|phtml|phar|pht)$/i
| TargetFileName!=/\/pub\/static\//i
| table([@timestamp, ComputerName, aid, TargetFileName, ImageFileName, UserName], limit=200)

// HUNT: Web/PHP process outbound connection (ingress tool transfer / C2)
// MITRE: T1071.001, T1105
// CONF: medium  FP: medium  COST: medium | REQUIRES: Linux NetworkConnectIP4
// FALSE POSITIVES: payment gateway / Adobe / package-repo callbacks
// TUNING: allow-list known gateway + vendor CIDRs; exclude RFC1918 RemoteAddressIP4
#event_simpleName=NetworkConnectIP4 event_platform=Lin
| ContextBaseFileName=/^(php-fpm|httpd|apache2|nginx|php|sh|bash|curl|wget)/i
| RemoteAddressIP4!=/^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.)/
| table([@timestamp, ComputerName, aid, ContextBaseFileName, RemoteAddressIP4, RemotePort], limit=200)

// HUNT: Reverse-shell command pattern on Magento web host
// MITRE: T1059.004, T1571
// CONF: high  FP: low  COST: low | REQUIRES: Linux ProcessRollup2
// FALSE POSITIVES: legitimate admin troubleshooting (rare)
// TUNING: scope to web hosts; alert on any match
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/ event_platform=Lin
| CommandLine=/(bash\s+-i|\/dev\/tcp\/|nc\s+(-[a-z]*e|--exec)|python[23]?\s+-c\s+.*socket|php\s+-r\s+.*fsockopen|fsockopen\(|socket_create)/i
| table([@timestamp, ComputerName, aid, ParentBaseFileName, ImageFileName, CommandLine, UserName], limit=200)

// HUNT: Cron persistence created from web-server context
// MITRE: T1053.003
// CONF: medium  FP: medium  COST: low | REQUIRES: Linux ProcessRollup2 + FileCreateInfo
// FALSE POSITIVES: Magento's own deploy-time cron entry
// TUNING: exclude known magento cron install line; alert on web-user-owned cron edits
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/ event_platform=Lin
| ParentBaseFileName=/^(php-fpm|httpd|apache2|nginx|php|sh|bash)/i
| (CommandLine=/crontab\s+(-|\/)/i or TargetFileName=/\/(etc\/cron|var\/spool\/cron)\//i)
| table([@timestamp, ComputerName, aid, ParentBaseFileName, ImageFileName, CommandLine, TargetFileName, UserName], limit=200)

// HUNT: CVE-2026-45247 CacheWarmer cookie exploit signature (HTTP/WAF logs)
// MITRE: T1190
// CONF: high  FP: medium  COST: medium | REQUIRES: HTTP access/WAF log ingest to NGSIEM
// FALSE POSITIVES: schema/field-name drift across log sources
// TUNING: map cookie field to your repo; serialized markers are never legit here
cookie := coalesce([http.request.cookie, request_cookies, cs_cookie, cookie])
| cookie=/CacheWarmer=(Tz|Qz|YT|O%3A|C%3A|a%3A|O:|C:|a:)/i
| table([@timestamp, source.address, url.path, http.request.method, cookie], limit=200)

Field-validation note: Q1–Q6 use core Linux Falcon fields (ImageFileName, ParentBaseFileName, CommandLine, TargetFileName, ContextBaseFileName, RemoteAddressIP4, aid, ComputerName, UserName) — all standard. Q7 targets forwarded HTTP/WAF logs, not EDR; its field names (http.request.cookie etc.) depend on your NGSIEM parser and must be mapped to your repo before use — ⚠ validate parser fields in tenant.

Promote the highest-fidelity behaviors (Q1, Q2, Q5) to Custom IOAs for real-time prevention on Magento web hosts. Build in Endpoint Security → Custom IOA Rule Groups, platform Linux, assign to a host group scoped to internet-facing commerce servers.

Roll out in Detect mode first. Run each IOA in Detect for one full deploy/maintenance cycle to confirm the exclusions cover legitimate static-content deploys and site cron, then flip the high-confidence rules (canary, reverse shell) to Block.

Quick-copy blocks for direct ingestion. No atomic IOCs are published yet — the Falcon IOC CSV uses REPLACE_WITH_... placeholders for values you extract during triage (webshell hash, skimmer domain, attacker IP).

type,value,action,severity,expiration,description,tags
sha256,REPLACE_WITH_WEBSHELL_SHA256,prevent,critical,2026-12-15,CVE-2026-45247 webshell payload,campaign:Mirasvit-CacheWarmer
domain,REPLACE_WITH_C2_OR_SKIMMER_DOMAIN,detect,high,2026-09-15,CVE-2026-45247 C2 / skimmer domain,campaign:Mirasvit-CacheWarmer
ipv4,REPLACE_WITH_ATTACKER_IP,detect,high,2026-09-15,CVE-2026-45247 exploit source IP,campaign:Mirasvit-CacheWarmer

cookie_signature: CacheWarmer=(Tz|Qz|YT|O:|C:|a:)
cmdline_canary:   PWNED_CVE2026
web_parent:       php-fpm | httpd | apache2 | nginx
shell_children:   sh | bash | dash | id | whoami | uname | curl | wget
webshell_path:    /(pub|media)/.*\.(php|phtml|phar|pht)$  (exclude /pub/static/)
revshell:         /dev/tcp/ | nc -e | fsockopen( | python -c .*socket

Monolog\Handler\SyslogUdpHandler
Monolog\Handler\BufferHandler
Monolog\Handler\FingersCrossedHandler
Monolog\Handler\GroupHandler
# PHP serialization markers (base64): Tz=>O:  Qz=>C:  YT=>a:
# Functions abused by chain: system()  current()

# Confirm Mirasvit FPC Warmer version (must be >= 1.11.12)
composer show mirasvit/module-cache-warmer 2>/dev/null | grep -i versions
php bin/magento module:status | grep -i Mirasvit_CacheWarmer
# Interim: disable the extension to remove the attack path
php bin/magento module:disable Mirasvit_CacheWarmer && php bin/magento cache:flush
# CISA KEV: CVE-2026-45247 | FCEB due 2026-06-06

Playbook A — Patch / mitigate the extension

## 1. Check installed version
composer show mirasvit/module-cache-warmer | grep -i versions
php bin/magento module:status | grep -i Mirasvit_CacheWarmer

## 2a. Patch (preferred)
composer require mirasvit/module-cache-warmer:^1.11.12 --update-with-dependencies
php bin/magento setup:upgrade
php bin/magento setup:di:compile
php bin/magento cache:flush

## 2b. Interim mitigation if patch is blocked
php bin/magento module:disable Mirasvit_CacheWarmer
php bin/magento cache:flush

## 3. Verify the version is >= 1.11.12
composer show mirasvit/module-cache-warmer | grep -i versions

Playbook B — Harden the web tier (nginx + PHP)

## Deny PHP execution under media/ (nginx) — drop in server block
location ~* /(media|pub/media)/.*\.(php|phtml|phar|pht)$ { deny all; return 403; }

## php.ini for the fpm pool (pilot before prod)
disable_functions = system,exec,shell_exec,passthru,popen,proc_open,proc_close
expose_php = Off
allow_url_include = Off

## Reload
php-fpm -t && systemctl reload php-fpm
nginx -t && systemctl reload nginx

Playbook C — WAF signature (ModSecurity-style)

## Block serialized-object CacheWarmer cookies
SecRule REQUEST_COOKIES:CacheWarmer "@rx ^(Tz|Qz|YT|O:|C:|a:)" \
  "id:2026045247,phase:1,deny,status:403,log,\
   msg:'CVE-2026-45247 Mirasvit CacheWarmer deserialization attempt'"

## Also flag abnormally long values
SecRule REQUEST_COOKIES:CacheWarmer "@gt 200" \
  "id:2026045248,phase:1,t:length,pass,log,\
   msg:'CVE-2026-45247 oversized CacheWarmer cookie'"

Gaps: rogue-admin creation and client-side skimmer injection sit outside EDR telemetry — cover them with Magento app/audit-log forwarding (Section 7, H8) and CSP/SRI monitoring respectively. The cookie-delivery signal (Q7) is only as good as your HTTP/WAF log pipeline into NGSIEM. Validation: run the gates in Section 11 before promoting any IOA; baseline Q3/Q6 across a deploy cycle to seed exclusions.