Redis RESTORE Command Flaw Exploited Five Months After Patch Was Available (CVE-2026-25243)

Scope: Redis redis-server, all versions prior to 8.6.3 (fixed in 6.2.22, 7.2.14, 7.4.9, and 8.2.6 or later for other branches)

Severity: Amber

Redis disclosed and patched CVE-2026-25243 back in May 2026, but threat intelligence firm Defused only caught real exploitation beginning on October 16 and 17, a reminder that a patch being available for months does not mean the risk has gone away, particularly for widely deployed open-source infrastructure where upgrade cycles lag behind disclosure. The flaw sits in Redis’s RESTORE command, which fails to properly validate serialized values, allowing an authenticated attacker who holds RESTORE permission to supply a crafted payload that triggers invalid memory access and can lead to remote code execution in the context of the Redis server process. The key detail here is that RESTORE access is often granted more broadly than it needs to be, since many deployments do not tightly scope ACL rules for application accounts, which widens the practical attack surface well beyond what the CVSS score alone might suggest. Organisations running Redis must upgrade to version 8.6.3 or later on the main branch, or the equivalent fixed version for their release line, and where immediate patching is not possible, restrict the RESTORE command through Redis ACL rules for any account that does not strictly require it.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.