Critical Vulnerability Puts 60,000 Redis Servers at Risk of Exploitation

A critical vulnerability in Redis, tracked as CVE-2025-49844 and rated with a CVSS score of 10/10, could allow authenticated attackers to execute arbitrary code remotely via a use-after-free in the Lua engine. The flaw has left about 60,000 Redis servers exposed to the internet without authentication, out of roughly 330,000 servers publicly reachable, according to Wiz.

On 3 October, Redis released patches for multiple versions (7.22.2-12, 7.8.6-207, 7.4.6-272, 7.2.4-138, 6.4.2-131) and OSS/CE versions 8.2.2, 8.0.4, 7.4.6, 7.2.11, plus Stack versions 7.4.0-v7 and 7.2.0-v19, with cloud deployments automatically updated but self-managed instances urged to upgrade promptly.

Wiz notes that the combination of no authentication and internet exposure enables attackers to run Lua scripts, escape the Lua sandbox, deploy a reverse shell, and subsequently harvest credentials or move laterally. Redis also recommends restricting network access, enforcing strong authentication, enabling protected-mode where applicable, and using minimum necessary permissions for accounts.

There is no evidence yet that CVE-2025-49844 has been exploited in the wild, but the warning emphasises the need for exposure management as thousands of nodes remain publicly reachable.