CVE-2026-25589, CVE-2026-25243: Redis RESTORE RCE Risk (July 2026)

CVE-2026-25589, CVE-2026-25243 — Redis RESTORE RCE

Two high-severity Redis vulnerabilities (CVE-2026-25589, CVE-2026-25243) allow authenticated attackers to achieve remote code execution (RCE) via memory corruption and out-of-bounds writes when abusing the RESTORE command. No active exploitation has been observed as of July 24, 2026, but immediate remediation is critical.

Attack Vector

Attackers must have valid Redis authentication credentials to exploit these flaws. By crafting malicious RESTORE commands, they can trigger memory corruption or out-of-bounds write conditions, enabling arbitrary code execution on the underlying server. The vulnerabilities stem from improper input validation in the RESTORE command handler, allowing attackers to overwrite memory regions and execute system-level commands. No specific indicators of compromise (IOCs) have been published, but unusual RESTORE command activity should be scrutinized.

Who Is at Risk

All organizations running Redis versions 6.2.22, 7.4.9, 8.6.4, and 8.8.0 are affected. Both cloud-hosted and on-premises Redis deployments are vulnerable if accessible to authenticated users. Redis is the only confirmed affected vendor; no other platforms are impacted by these CVEs.

Patch & Mitigate

• Patch: Upgrade Redis to the latest patched versions (6.2.22, 7.4.9, 8.6.4, or 8.8.0) released July 23, 2026. Apply security updates immediately.
• Workaround: Restrict access to Redis servers using network segmentation and strong authentication. Disable RESTORE command for untrusted users if possible.
• Detect: Monitor logs for abnormal RESTORE command usage, especially from unexpected sources or accounts. Review for signs of memory errors or crashes.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers require valid credentials to access and exploit Redis.
• TA0005 — Defense Evasion: Exploitation may allow attackers to execute code while bypassing standard controls.
• TA0007 — Discovery: Attackers may probe Redis environments to identify exploitable instances.

Source: https://thehackernews.com/2026/07/kimi-k3-agents-found-redis-zero-days.html