Loading story…
A long-lived Redis memory-corruption flaw dubbed RediShell (CVE-2025-49844) was reported as a use-after-free bug that can lead to remote code execution under certain conditions. Although exploitation requires authentication, research noted that tens of thousands of Redis instances have historically been exposed to the internet without authentication enabled, increasing real-world risk; the issue was discovered by Wiz and demonstrated at Pwn2Own Berlin prior to public disclosure.
Separately, IceWarp disclosed a critical unauthenticated RCE (CVE-2025-14500) caused by OS command injection in handling of the X-File-Operation HTTP header, impacting both Windows and Linux deployments and enabling arbitrary command execution as SYSTEM/root. The flaw was reported in September 2025 and fixed in October 2025 across supported product lines, but Shadowserver reported more than 1,200 internet-facing on-prem instances still unpatched and said it is notifying affected owners to upgrade.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
On March 5, 2026, CSO Online published a roundup of long-lived software flaws, including the Redis use-after-free bug CVE-2025-49844, LionWiki path traversal issues, a sudo host logic flaw, HashiCorp Vault and CyberArk Conjur logic bugs disclosed at Black Hat USA 2025, GRUB2 Secure Boot-related flaws, and the recently fixed Telnet bypass. The article summarizes previously disclosed technical findings rather than introducing a new incident.
By early March 2026, the Shadowserver Foundation reported more than 1,200 internet-facing IceWarp instances remained vulnerable to CVE-2025-14500 and said it was notifying owners to update. IceWarp support urged prompt upgrades and backups before patching, while CCB warned patching would not undo any prior compromise.
A Telnet authentication bypass vulnerability, CVE-2026-24061, that had existed since May 2017 was fixed in January 2026. The bug could enable remote compromise when the service is exposed to the internet.
In October 2025, IceWarp fixed CVE-2025-14500 across multiple supported product generations and versions. The Centre for Cybersecurity Belgium later described the issue as insufficient validation of user-supplied data before it is passed to a system call.
The critical unauthenticated OS command injection vulnerability CVE-2025-14500 in IceWarp was reported in September 2025. The flaw affects handling of the X-File-Operation header and can allow arbitrary command execution as SYSTEM on Windows or root on Linux.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Redis disclosed five vulnerabilities affecting Redis Cloud, Redis Software, and Redis OSS/CE that could allow authenticated attackers to achieve **remote code execution**, system compromise, data exfiltration, or service disruption. The issues tracked as `CVE-2026-23479`, `CVE-2026-25243`, `CVE-2026-25588`, `CVE-2026-25589`, and `CVE-2026-23631` include an invalid memory access flaw in the `RESTORE` command, a use-after-free bug in the unblock client flow, and a Lua use-after-free condition in certain replica configurations. Public advisories and downstream alerts described four of the bugs as high severity and one as medium severity, with multiple flaws capable of leading to arbitrary code execution. Redis said **Redis Cloud** deployments had already been patched and required no customer action, while self-managed users were told to upgrade to fixed releases across Redis OSS/CE, Redis Software, RedisTimeSeries, and RedisBloom. Government and national CERT notices echoed the vendor guidance and urged administrators to review the advisories and apply updates promptly. Redis also said it had **no evidence of active exploitation** at publication time, but recommended immediate patching and hardening measures such as restricting network exposure, enforcing strong authentication, keeping protected mode enabled where appropriate, and applying least-privilege access controls.
Jun 29, 2026
Researchers disclosed multiple authenticated remote code execution paths in Redis, showing how users with valid Redis credentials could potentially escalate from datastore access to host-level shell access on stock builds including Redis `6.2.22`, `7.4.9`, `8.6.4`, and `8.8.0`. The reported issues include a stream consumer-group shared-`NACK` double-free linked to the `CVE-2026-25589` incomplete-fix family and a heap overflow in the bundled RedisBloom `TDigest` module affecting Redis `8.8.0`. The attack chains rely on commonly enabled capabilities such as `EVAL`, `RESTORE`, and `XGROUP`, and the report said the double-free was only fully fixed in `8.8.0` while that same release still remained exposed to the RedisBloom bug at disclosure time. At the same time, new offensive-security tooling emerged to help identify exposed Redis deployments. A Rapid7 Metasploit pull request introduced an auxiliary scanner for `CVE-2025-49844` ("RediShell") that checks whether a Redis server is running an unpatched branch and whether Lua `EVAL` is reachable, highlighting how configuration choices such as ACLs can reduce practical exploitability even on vulnerable versions. The combined disclosures underscore the need to patch Redis promptly, restrict dangerous commands, keep Redis off the public internet, rotate credentials, review RedisBloom usage, and monitor for anomalous command activity that could indicate exploitation attempts.
Jul 24, 2026
Redis disclosed and fixed five vulnerabilities in Redis OSS/CE, including four high-severity issues and one medium-severity flaw, warning that several bugs could lead to remote code execution after authentication. The most serious issue, **`CVE-2026-23479`**, is a use-after-free in blocking-client code that can enable arbitrary OS command execution on the host running Redis; Redis said it affects versions beginning with `7.2.0` across multiple stable branches. The broader set of flaws also includes invalid memory access bugs in the `RESTORE` command, including module-specific cases involving **RedisTimeSeries** and **RedisBloom**, as well as a Lua use-after-free affecting certain replica configurations.
Jun 29, 2026