A Redis RCE patched since May is now being exploited
Canada's cyber centre confirms attacks on CVE-2026-25243 after honeypots caught scripted exploitation attempts on 16 and 17 October. Upgrade to Redis 8.6.3 or later.
Redis’s Canadian Centre for Cyber Security advisory was updated on 19 October to say CVE-2026-25243 “is being exploited in the wild”, the first of five CVEs from Redis’s May disclosure to see confirmed attacks. The bug is an invalid memory access in the RESTORE command, CVSS 7.7, that can crash a server or lead to remote code execution.
Honeypot operator Defused reported scripted exploitation attempts against its Redis decoys on 16 and 17 October, with one attacker wiping the keyspace afterwards to cover its tracks. Redis’s own advisory says exploitation requires authenticated access to the instance, which is exactly the problem: a large number of Redis deployments run with no authentication configured at all. The fix landed in Redis OSS/CE 8.6.3 back in May, alongside point releases for 8.2.x, 8.4.x, 7.4.x, 7.2.x and Redis Software.
Why it matters: if you’re running a self-managed Redis instance without authentication or network restrictions, this is no longer a theoretical risk. Check your version against Redis’s fixed-release table, and if you can’t patch immediately, require auth and firewall the port in the meantime.
The caveat: this isn’t yet on CISA’s Known Exploited Vulnerabilities list, and the attacks so far look like scripted, opportunistic scanning rather than a targeted campaign.