Redis RESTORE flaw now exploited, five months after the fix

Redis RESTORE flaw now exploited, five months after the fix

19 October 2026: The Canadian Centre for Cyber Security updated its Redis advisory on 19 October to say that CVE-2026-25243, a flaw in the RESTORE command that can let an authenticated user run code on the server, "is being exploited in the wild". Redis fixed it on 5 May, so any instance still exposed is one that missed five months of patch releases.

Not yet independently verified. The exploitation report rests on the Cyber Centre citing unnamed open-source reporting; Redis's own advisory still says it had no evidence of exploitation when it was published on 5 May, and the flaw is not in the CISA KEV catalogue. We will update this when it can be confirmed, and remove this note.

What the flaw does

CVE-2026-25243 is an invalid memory access in RESTORE, the command that loads a serialized value back into the database. Redis says a crafted payload "could allow an attacker with authenticated access to execute arbitrary code in the context of the Redis server", and rates it CVSS 7.7. The attacker needs a valid login, which on many internal deployments means the shared default user or a password kept in application config. The same advisory fixed four related bugs:

• CVE-2026-25588 and CVE-2026-25589: the same RESTORE flaw through the RedisTimeSeries and RedisBloom modules (CVSS 7.7)
• CVE-2026-23479: a use-after-free in the unblock-client flow that can also lead to code execution (CVSS 7.7)
• CVE-2026-23631: a Lua use-after-free on replicas with replica-read-only disabled (CVSS 6.1)

Fixed releases

Product	Fixed in
Redis OSS and Community Edition	6.2.22, 7.2.14, 7.4.9, 8.2.6, 8.4.3, 8.6.3
Redis Software	7.2.4-153, 7.4.6-279, 7.8.6-253, 7.22.2-79, 8.0.10-64
RedisTimeSeries	v1.8.23, v1.10.24, v1.12.14
RedisBloom	v2.4.23, v2.6.28, v2.8.20

Redis Cloud was patched by Redis and needs no customer action. Every earlier release of each line is affected.

Where unpatched copies tend to sit

Redis is often installed once and forgotten: as a cache bundled with a container image, a session store behind a web application, or a queue backend that a vendor appliance ships with its own copy. Those copies only change when the image or appliance is rebuilt, which is why a May fix can still be missing in October. Redis's own mitigations apply while an upgrade is scheduled: keep instances off public networks, require authentication with per-application users, leave protected-mode on, and use ACLs to deny RESTORE to users that never need it.

The Cyber Centre does not name the reporting it relies on or say which versions are being attacked. Our NoSQL database category lists 27 products, including Redis.

Sources

• Canadian Centre for Cyber Security: Redis security advisory AV26-423, Update 1, 19 October 2026
• Redis: security advisory for CVE-2026-23479, CVE-2026-25243, CVE-2026-25588, CVE-2026-25589 and CVE-2026-23631, 5 May 2026