Vulnerabilities · 52 days ago

Redis RESTORE Becomes the Code-Execution Gate

Redis’s recovery path is the problem here. A login that can use RESTORE can push Redis into authenticated remote code execution, so patching the server is only half the story if broad restore rights remain in place.

Researchers published PoCs against stock Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0, and Redis shipped seven fixes the same day. The affected bugs split into two families: a Streams shared-NACK use-after-free, and out-of-bounds writes in the bundled RedisBloom and TDigest loaders. Fixed releases are 6.2.23, 7.2.15, 7.4.10, 8.2.8, 8.4.5, 8.6.5, and 8.8.1.

The practical risk is that RESTORE is a normal-looking permission with an unsafe blast radius. If application or admin accounts keep it, the exploit path can remain open wherever patching lags, especially on systems that use RedisBloom or TDigest.

CVE-2026-25243

NVD KEV

CVSS 8.8 HIGH: redis is an in-memory data structure store. EPSS 4% (89th percentile).

CVE-2026-25589

NVD KEV

CVSS 8.8 HIGH: redisBloom is a probabilistic data structures module for Redis. EPSS 1% (72nd percentile).

Timeline

Jul 24 Reported by The Hacker News

Sources

1 source covering this story

The Hacker News Jul 24
Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say
Redis ships seven security releases after authenticated RESTORE RCE PoCs target versions 6.2.22, 7.4.9, 8.6.4, and 8.8.0.

Entities

CVE-2026-25589
CVE-2026-25243
Kimi K3 Agents

Part of the PlainSec briefing for 2026-07-25

Editions

Vulnerabilities · 52 days agoRedis RESTORE Becomes the Code-Execution GateRedis’s recovery path is the problem here. A login that can use RESTORE can push Redis into authenticated remote code execution, so patching the server is only half the story if broad restore rights remain in place.Researchers published PoCs against stock Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0, and Redis shipped seven fixes the same day. The affected bugs split into two families: a Streams shared-NACK use-after-free, and out-of-bounds writes in the bundled RedisBloom and TDigest loaders. Fixed releases are 6.2.23, 7.2.15, 7.4.10, 8.2.8, 8.4.5, 8.6.5, and 8.8.1.The practical risk is that RESTORE is a normal-looking permission with an unsafe blast radius. If application or admin accounts keep it, the exploit path can remain open wherever patching lags, especially on systems that use RedisBloom or TDigest.