Detect Mirasvit Full Page Cache Warmer Deserialization RCE (CVE-2026-45247) in Elastic Security
Detects exploitation of CVE-2026-45247, a deserialization of untrusted data vulnerability in the Mirasvit Full Page Cache Warmer Magento extension. Successful exploitation allows remote attackers to execute arbitrary code by sending crafted serialized PHP objects to vulnerable endpoints. This CVE is listed in CISA KEV, indicating active exploitation in the wild.
MITRE ATT&CK
- Tactic
- Initial Access Execution Persistence
Elastic Detection Query
sequence by source.ip with maxspan=5m
[network where event.dataset in ("nginx.access", "apache.access", "iis.access")
and url.path : ("*/cache-warmer*", "*/mirasvit*", "*/cachewarmer*")
and http.request.method in ("POST", "PUT")
and http.request.body.bytes > 500]
[any where event.category == "process"
and process.name in ("php", "php-fpm", "php7*", "php8*")
and (
process.command_line : ("*eval*", "*base64_decode*", "*system(*", "*exec(*", "*shell_exec(*", "*passthru(*")
or process.parent.name in ("nginx", "apache2", "httpd", "php-fpm")
)]Correlates suspicious POST requests to Mirasvit cache warmer endpoints with subsequent PHP process execution exhibiting code evaluation or shell execution patterns, indicating successful deserialization exploitation.
Data Sources
Required Tables
False Positives & Tuning
- PHP-FPM spawning legitimate child processes in response to cache warm requests
- Security tools performing dynamic code analysis on the application
- Legitimate Magento cron or queue workers executing PHP in the context of cache operations
- Development environments running eval-heavy debugging code
Other platforms for CVE-2026-45247
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Deserialization Probe to Cache Warmer Endpoint
Expected signal: POST request to /mirasvit/cachewarmer/collect visible in web access logs with payload containing 'O:8:' serialization marker; HTTP response code logged
- Test 2PHP Deserialization Gadget Chain Simulation (Lab)
Expected signal: PHP CLI process spawned with command-line containing unserialize() — visible in auditd execve records or CrowdStrike process telemetry
- Test 3Web Shell Drop Simulation Following Deserialization RCE
Expected signal: File creation event in /var/www/html/pub/ for a .php file by the web server user (www-data or nginx); auditd CREATE record or Falcon sensor file event
Unlock Pro Content
Get the full detection package for CVE-2026-45247 including response playbook, investigation guide, and atomic red team tests.