Critical RediShell RCE Vulnerability Threatens 8,500+ Redis Deployments Worldwide

A critical security vulnerability known as RediShell RCE has left thousands of Redis deployments exposed to remote code execution via Redis’s Lua scripting engine. The flaw, tracked as CVE-2025-49844, was publicly disclosed in early October 2025 by cloud security firm Wiz, describing a use-after-free memory corruption issue that allows attackers to escape the Lua sandbox and achieve host-level compromise.

With over 8,500 vulnerable instances exposed to the internet as of late October, patching has become urgent for Redis administrators and security teams. According to threat intelligence analysis using Criminal IP Asset Search, a total of 59,755 Redis instances were identified as internet-exposed as of 27 October 2025, with the United States hosting the largest concentration at 11,863.

Geographically, France and Germany also appear among the top exposures, and when filtered for CVE-2025-49844, about 8,500 instances worldwide were flagged as vulnerable and unpatched. The exploitation sequence typically begins with a malicious Lua script that escapes the sandbox, followed by persistence mechanisms such as reverse shells or backdoors to enable ongoing access.