Do Son 
TL;DR
On October 16-17, 2026, Defused’s honeypots caught attackers exploiting CVE-2026-25243, a Redis RESTORE vulnerability rated CVSS 7.7. The memory bug can lead to remote code execution for users who can run RESTORE. Redis 8.6.3 fixes it.
- CVE: CVE-2026-25243
- CVSS: 8.8 (High · CVSSv3)
- Product: redis
- Affected: < 8.6.3
- Impact: redis-server RESTORE invalid memory access may allow remote code execution
- Status: Exploited in the wild
- EPSS: 3.3% (30-day)
- Action: See vendor advisory
Why It Matters
Redis sits behind many web apps as a cache and data store. Many instances also run with weak or shared credentials. As a result, the login requirement may offer less protection than it seems.
Redis disclosed the flaw in May 2026, yet unpatched servers remain. According to the Redis security advisory, “This problem affects all Redis versions.”
How the Attack Works
The RESTORE command rebuilds a key from serialized data. However, Redis does not fully check those values. A crafted payload can trigger an invalid memory access. Redis warns this could “execute arbitrary code in the context of the Redis server.”
Notably, the attacker must log in and hold permission to run RESTORE.
Exploitation status
The Redis RESTORE vulnerability is now exploited in the wild. Defused reported on X that its Redis decoys “recorded repeated scripted attempts” overnight. The firm added: “No prior public report exists of this CVE being attempted in the wild.”
One attacker hit a decoy five times on a timer with the same payload. Each run ended by wiping the keyspace, destroying data and its own traces. CISA has not yet added the flaw to its KEV catalog.
Affected Versions
All Redis versions before 8.6.3 are affected. Wiz Research’s Emil Lerner and researcher Joseph Surin reported the bug.
Patch and Mitigation Steps
- Upgrade to Redis 8.6.3, or apply your Linux vendor’s patched package.
- Block the RESTORE command with an ACL rule if you cannot patch yet.
- Require strong, unique passwords and keep Redis off the internet.
With this Redis RESTORE vulnerability exploited in the wild, admins should patch or restrict RESTORE now.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
