Redis patches authenticated RCE flaws in versions 6.2–8.8

Affected Systems

Redis versions 6.2.22, 7.2.14, 7.4.9, 8.2.7, 8.4.4, 8.6.4, and 8.8.0. Exploitation requires authenticated access and RESTORE command privileges. Streams-based chain also requires EVAL and XGROUP commands; RedisBloom chain (8.8.0) requires EVAL and bundled RedisBloom module.

Exploitation Status

Proof-of-concept exploits published and functional. No in-the-wild exploitation reported as of July 24, 2026. Exploitation requires authenticated access to Redis instance.

Business Impact

Authenticated attackers with RESTORE privileges can achieve remote code execution on vulnerable Redis servers. Two distinct exploit chains exist: a Streams shared-NACK use-after-free (affects 6.2–8.6) and a RedisBloom TDigest out-of-bounds write (affects 8.8.0). Risk is elevated for Redis instances exposed to untrusted authenticated users or where credential compromise has occurred. May 2026 patches (6.2.22, 7.4.9) were incomplete and remain vulnerable. No CVE assigned yet for July findings; existing CVE-2026-25243 and CVE-2026-25589 cover May issues only.

Urgency

🟠 Within 24 hours

Recommended Actions

• Upgrade Redis immediately: 6.2.x to 6.2.23, 7.2.x to 7.2.15, 7.4.x to 7.4.10, 8.2.x to 8.2.8, 8.4.x to 8.4.5, 8.6.x to 8.6.5, or 8.8.x to 8.8.1
• Revoke RESTORE command privileges from all Redis accounts that do not strictly require it using ACL rules (e.g., 'ACL SETUSER -restore')
• Block untrusted network access to Redis ports (default 6379) using firewall rules or network segmentation
• Audit Redis ACLs and authentication logs for unauthorized RESTORE, EVAL, XGROUP command usage or suspicious RDB object restoration activity
• Verify deployed version with 'redis-server --version' — do not assume May 2026 patches are sufficient