KISA urges Redis update to fix CVE-2026-25243 RCE flaw

KISA recommended a security update on October 29 for CVE-2026-25243, a remote code execution vulnerability in Redis, according to dailysecu.com. The flaw is a memory access issue in Redis's RESTORE command.

An authenticated attacker who sends specially crafted data could trigger a memory error and, under certain conditions, achieve remote code execution. All five of the vulnerabilities covered in the advisory require the attacker to first gain authenticated access to the server.

KISA listed fixed versions as 6.2.22, 7.2.14, 7.4.9, 8.2.6, 8.4.3 and 8.6.3. Four of the five flaws carry a CVSS score of 7.7; the remaining one scores 6.1.

Other flaws in the same advisory

CVE-2026-23479 is a use-after-free vulnerability in the process of unblocking blocked clients. CVE-2026-25588 and CVE-2026-25589 affect environments using the RedisTimeSeries and RedisBloom modules respectively, both via the RESTORE command. CVE-2026-23631 is a vulnerability in the synchronization process between Lua scripts and replica servers.

Redis published an official security advisory disclosing and fixing the five vulnerabilities on May 5, 2026, and said it had already applied the relevant patches to its managed Redis Cloud service.

KISA recommended restricting external network access, enforcing strong authentication and minimizing per-user command execution privileges. KISA's official advisory lists no actual attacks exploiting these vulnerabilities in Korea.