DEFUSED’S honeypots have observed active exploitation of Redis RESTORE flaw CVE-2026-25243 in mid-October 2026. The memory-corruption vulnerability, rated CVSS 7.7, enables remote code execution for Redis servers that permit the RESTORE command. The vulnerable versions are all Redis releases prior to 8.6.3, with Redis 8.6.3 providing the official fix.
Evidence from the researchers indicates repeated scripted attempts detected by decoy instances, with attackers attempting the same payload multiple times before wiping the keyspace and their traces. The advisory notes that the vulnerability could allow code execution in the Redis server’s context if exploited successfully.
How the attack works is straightforward in concept: the RESTORE command reconstructs a key from serialized data, but Redis does not fully validate all payload values, allowing crafted input to trigger an invalid memory access. An attacker must first log in and possess permission to run RESTORE. The exploitation observed in the wild confirms that unauthorised access is not required in all cases, but login with RESTORE rights is necessary.
The impact is remote code execution, potentially allowing an attacker to take control of the server. Administrators are advised to patch promptly or mitigate by ACLs to block RESTORE and to strengthen credentials while keeping Redis off the internet. EPSS signals indicate a 30-day exposure of 3.3%, underscoring the urgency of applying Redis 8.6.3 or vendor-provided patches.