Redis flaws include CVE-2026-25243, reported exploited in the wild
Original title: Redis security advisory (AV26-423) - Update 1
Canada’s Cyber Centre says open-source reporting shows CVE-2026-25243 is exploited and urges Redis updates.
The Canadian Centre for Cyber Security updated advisory AV26-423 on October 19, 2026, covering a May 5 Redis security advisory for Redis Software and Redis OSS/CE. Update 1 says open-source reporting indicates CVE-2026-25243 is being exploited in the wild. The bulletin lists five CVEs and tells users and administrators to review Redis’s links and apply the necessary updates. Affected version ranges and fixed releases are not stated in this alert.
Unconfirmed: Exploitation of CVE-2026-25243 is attributed to open-source reporting, not to Redis or the Cyber Centre directly.
- The original Redis advisory date in the alert is May 5, 2026.
- Products named are Redis Software and Redis OSS/CE, both “multiple versions.”
- Listed CVEs are CVE-2026-23479, CVE-2026-25243, CVE-2026-25588, CVE-2026-25589, and CVE-2026-23631.
- Only CVE-2026-25243 is described as exploited in the wild.
| Product | Affected |
|---|---|
| Redis Software | multiple versions |
| Redis OSS/CE | multiple versions |
- 1.Review the Redis security advisory links and apply the necessary updates.
- Vendors
- Redis
- Products
- Redis SoftwareRedis OSS/CE
- Organizations
- Canadian Centre for Cyber Security
- Countries
- Canada
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-25243+1 related CVE | Redis: In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated… | 7.7 group max | 4% | ||
| CVE-2026-25588 | RedisTimeSeries: The module does not properly validate serialized values processed through the Redis RESTORE command. An authenticated attacker… | 7.7 | 1% |
From the original article
1 min read at cyber.gc.ca
Serial number: AV26-423 Date: May 5, 2026 Updated: October 19, 2026 On May 5, 2026, Redis published a security advisory to address vulnerabilities in the following products: Redis Software – multiple versions Redis OSS/CE releases – multiple versions Update 1 Open-source reporting indicates that CVE-2026-25243 is being exploited in the wild.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.