Affected Systems
Redis versions 6.2.22, 7.2.14, 7.4.9, 8.2.7, 8.4.4, 8.6.4, and 8.8.0. Exploitation requires authenticated access and use of RESTORE command. Streams-based chains also require EVAL and XGROUP commands; Redis 8.8.0 chain requires EVAL and bundled RedisBloom module. Fixed in Redis 6.2.23, 7.2.15, 7.4.10, 8.2.8, 8.4.5, 8.6.5, and 8.8.1.
Exploitation Status
Proof-of-concept exploits published for Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0. No in-the-wild exploitation reported as of July 24, 2026 per Redis release notes and public PoC repositories.
Business Impact
Authenticated attackers can achieve remote code execution through memory corruption flaws. Two attack paths exist: (1) Streams shared-NACK use-after-free via corrupt RDB objects leading to double-free and arbitrary memory access, and (2) RedisBloom TDigest RDB loader out-of-bounds write enabling read/write primitives and libc address leaks. Both chains poison database hash functions to invoke system() calls. Redis 6.2.22 and 7.4.9 were May 2026 security updates, meaning organizations that patched in May remain vulnerable. No CVE identifiers or CVSS scores assigned to July findings as of July 24, 2026. Authentication requirement and need to revoke RESTORE command reduce immediate risk, but public PoCs lower exploitation barrier.
Urgency
🟠 Within 24 hours
Recommended Actions
- Upgrade Redis to fixed versions: 6.2.23, 7.2.15, 7.4.10, 8.2.8, 8.4.5, 8.6.5, or 8.8.1 depending on deployed branch
- Verify exact Redis version using redis-server --version; do not assume May 2026 patches (6.2.22, 7.4.9) are sufficient
- Revoke RESTORE command permissions from Redis accounts that do not strictly require it using ACL DELUSER or ACL SETUSER commands
- Block untrusted network access to Redis instances; enforce authentication and restrict access to trusted IP ranges only
- Monitor Redis logs for unexpected RESTORE, EVAL, XGROUP commands or RedisBloom module usage from non-administrative accounts