CVE-2026-25243: RCE in Redis Server 8.6.3

Successful exploitation of CVE-2026-25243 allows an authenticated attacker to execute arbitrary code on the Redis server. This could lead to complete system compromise, data exfiltration, and denial of service. The attacker needs permission to execute the RESTORE command, which is typically granted to administrative users. The blast radius extends to any data stored within the Redis instance, potentially impacting applications and services relying on it. While not directly analogous to Log4Shell, the exploitation pattern of leveraging a deserialization process to achieve RCE shares similarities.

1. Veröffentlicht2026-05-05
2. Geändert2026-05-06
3. EPSS aktualisiert2026-05-13

The primary mitigation for CVE-2026-25243 is to upgrade to Redis Server version 8.6.3 or later. If immediate upgrade is not possible, restrict access to the RESTORE command using ACL rules. This limits the ability of attackers to execute the vulnerable command. Consider implementing a Web Application Firewall (WAF) or proxy to filter potentially malicious RESTORE requests. Monitor Redis logs for suspicious activity related to the RESTORE command. After upgrading, confirm the fix by attempting a RESTORE operation with a known malicious payload – it should be rejected.