Redis RCE in 2026: Five Patched CVEs and the 27-Minute AI Discovery Defenders Should Note

On May 5 2026, Redis published a single advisory patching five separate vulnerabilities, four of them rated CVSS 7.7 High, every one a post authentication path that may lead to remote code execution on a self managed Redis server (Redis Security Advisory). The National Vulnerability Database scores the RedisBloom flaw among them, CVE-2026-25589, at CVSS v3.1 8.8 High (NVD). The Canadian Centre for Cyber Security mirrored the same set as advisory AV26-423 the same day (Canadian Centre for Cyber Security). The common thread across most of these bugs is the RESTORE command mishandling a crafted serialized payload, in the core and in bundled modules.

Then, on July 23 2026, a wave of tech press reported something different and louder: Moonshot AI's Kimi K3 autonomous agent had reportedly surfaced Redis class RCE paths in as little as 27 minutes (CyberPress; Cybersecurity News). Those two events are not the same event, and conflating them is the single biggest reporting error circulating this month. The five patched CVEs were credited by Redis to named human researchers. The 27 minute claim is a separate, still developing story with public proofs of concept and no confirmed CVE assignment. This post keeps them cleanly apart.

Here is the direct answer defenders came for. The 2026 Redis RCE CVEs are CVE-2026-23479, CVE-2026-25243, CVE-2026-25588, CVE-2026-25589, and CVE-2026-23631, all patched by Redis on May 5 2026. You are affected if you self manage Redis Software, OSS, or CE, especially with the RedisBloom or RedisTimeSeries modules loaded; Redis Cloud is already patched. And yes, an autonomous AI reportedly found Redis class RCE paths in about 27 minutes, but that July 2026 claim is a distinct event from the five May 2026 CVEs, which humans reported.

This post is the Stingrai research team's canonical 2026 reference for the Redis RCE CVEs and the AI discovery claim. It carries every figure with attribution to three primary publishers: Redis, the National Vulnerability Database, and the Canadian Centre for Cyber Security, plus clearly labelled tech press for the separate Kimi K3 story. The advisory data is the freshest available: the five CVEs were disclosed May 5 2026 and the AI claim surfaced July 23 2026. Every stat below carries its source, year, and severity basis so any claim can be audited against the primary advisory inline. There are no proof of concept steps or payloads here; this is a defender briefing.

TL;DR: the 2026 Redis RCE CVEs at a glance

• Five CVEs, one advisory (2026): Redis patched CVE-2026-23479, CVE-2026-25243, CVE-2026-25588, CVE-2026-25589, and CVE-2026-23631 on May 5 2026, all post authentication RCE paths (Redis Security Advisory).

• RedisBloom is the highest on NVD (2026): CVE-2026-25589 is listed at CVSS v3.1 8.8 High for all RedisBloom versions before 2.8.20 (NVD).

• Four High, one Medium (2026): the Redis advisory rates the four memory safety RCE flaws at CVSS 7.7 High and the Lua use after free at 6.1 Medium (Redis Security Advisory).

• RESTORE is the pivot (2026): three flaws abuse a crafted serialized payload through the RESTORE command, two of those through the RedisBloom and RedisTimeSeries modules (Redis Security Advisory).

• Fixed core builds (2026): upgrade Redis OSS or CE to 6.2.22, 7.2.14, 7.4.9, 8.2.6, 8.4.3, or 8.6.3 (Redis Security Advisory).

• Fixed RedisBloom (2026): upgrade the module to v2.8.20, v2.6.28, or v2.4.23 (Redis Security Advisory).

• Fixed RedisTimeSeries (2026): upgrade the module to v1.12.14, v1.10.24, or v1.8.23 (Redis Security Advisory).

• Redis Cloud already patched (2026): the exposed population is self managed Redis Software, OSS, and CE (Redis Security Advisory).

• No known exploitation at disclosure (2026): Redis reported no evidence of exploitation in its own or customer environments as of the advisory (Redis Security Advisory).

• Canada advisory (2026): the Canadian Centre for Cyber Security issued AV26-423 on May 5 2026 covering the same five CVEs (Canadian Centre for Cyber Security).

• The AI claim is separate (2026): the reported 27 minute Kimi K3 discovery is a distinct, developing tech press story, not the five patched CVEs (CyberPress).

Key takeaways

The AI headline and the patched CVEs are two different stories, and the difference matters. Redis credited the five May 2026 CVEs to named human researchers in its own advisory (Redis Security Advisory). The separate July 2026 claim that an autonomous agent found Redis class RCE paths in about 27 minutes is real coverage, but it is a distinct, developing event with no confirmed CVE assignment (CyberPress). If a briefing blurs the two, it credits an AI with human work and misstates what has actually been patched.

These are post authentication flaws, which changes the risk model, not the urgency. Every one requires an attacker to already hold authenticated access before it can be reached (Redis Security Advisory). That is not comfort: exposed Redis instances, reused credentials, over broad ACLs, and application service accounts with RESTORE rights all convert a foothold into code execution on the datastore. Post auth RCE on a core data service is a full compromise primitive.

RESTORE and loaded modules are where the exposure concentrates. Three of the five flaws run through the RESTORE command and a crafted serialized payload, and two of those are reachable specifically when the RedisBloom or RedisTimeSeries modules are loaded (Redis Security Advisory). Teams that run these probabilistic and time series modules carry more of this surface than a plain key value cache does.

Patching means two coordinated upgrades, not one. The core fix (Redis OSS or CE 8.6.3 and the earlier line fixes) does not patch the module flaws. RedisBloom must reach v2.8.20 and RedisTimeSeries must reach v1.12.14 on their respective lines to close CVE-2026-25589 and CVE-2026-25588 (Redis Security Advisory). A core only upgrade can leave a loaded module vulnerable.

Autonomous discovery of core infrastructure bugs is now a defender planning assumption. Whether or not the specific 27 minute figure holds up, the direction is clear: agentic tooling compresses discovery on widely deployed software, and open weights lower the barrier further (Cybersecurity News). The defensive answer is not a single annual test but continuous, threat led validation of the paths that matter.

Methodology

This briefing draws on three primary sources plus clearly labelled tech press, with publication windows noted:

• Redis, Security Advisory (published May 5 2026): the authoritative source for the five CVE identifiers, flaw descriptions, the CVSS 7.7 and 6.1 ratings, affected and fixed versions for core and modules, remediation guidance, exploitation status, and the human researcher credits.

• National Vulnerability Database (retrieved July 2026): used for CVE-2026-25589's independent CVSS scoring (v3.1 8.8 High, v4.0 7.7 High), the CWE-122 heap based buffer overflow classification, and the RedisBloom before 2.8.20 version boundary.

• Canadian Centre for Cyber Security, advisory AV26-423 (issued May 5 2026): used as the Canadian government mirror confirming the same five CVEs and the patch guidance.

• Tech press for the separate AI claim (published July 23 2026): CyberPress and Cybersecurity News, used only for the developing, not yet CVE assigned Kimi K3 story, and kept explicitly distinct from the patched CVEs.

Research cutoff for this pass was July 23 2026. Every numeric claim above traces to one of these named sources. Where a figure could not be confirmed against a primary advisory, it was left out rather than estimated. Severity numbers are presented on their stated basis: the Redis advisory rating where Redis is the source, and the NVD rating where NVD is the source, so the two are never silently merged.

The five CVEs, defender altitude

At a CISO briefing altitude, the pattern is simple. Four of the five bugs are memory safety defects, a use after free or an invalid memory access, that an authenticated client can trigger to run code inside the Redis process. The fifth is a Lua scripting use after free. None is a pre authentication internet worm; all of them turn authenticated access to Redis into potential code execution on the host.

All ratings and descriptions above are from the Redis Security Advisory, with the additional NVD score for CVE-2026-25589 from the NVD.

Figure 1: The five Redis 2026 CVEs by CVSS severity and component. Source: Redis Security Advisory (May 5 2026); NVD score shown for CVE-2026-25589.

The RESTORE thread

The RESTORE command rebuilds a key from a serialized value, the same format DUMP produces. Three of these flaws, CVE-2026-25243 in the core and CVE-2026-25588 and CVE-2026-25589 in the modules, share the same shape: a specially crafted serialized payload passed to RESTORE reaches an invalid memory access that an authenticated attacker can steer toward code execution (Redis Security Advisory). NVD classifies the RedisBloom case as a heap based buffer overflow, CWE-122, rooted in the module not validating serialized values before it processes them (NVD). The practical takeaway for defenders is that RESTORE is a privileged, high blast radius command, and any identity that can call it against a vulnerable build is a code execution risk.

The module multiplier

CVE-2026-25588 and CVE-2026-25589 only bite when the RedisTimeSeries or RedisBloom modules are loaded. That is a meaningful scoping signal. A team running a plain Redis cache with no modules still needs the core fixes for CVE-2026-23479, CVE-2026-25243, and CVE-2026-23631, but does not carry the two module CVEs. A team running Bloom filters, cardinality sketches, or time series workloads carries the full set and needs both the core and the module upgrades.

The Lua edge case

CVE-2026-23631 is the outlier at 6.1 Medium. It is a Lua use after free reachable through the master replica synchronization mechanism, and, per the advisory, it affects only replicas configured, or configurable, with replica-read-only disabled, in Redis builds that ship Lua scripting (Redis Security Advisory). If you keep replica-read-only enabled, which is the default posture, your exposure to this specific flaw is narrower. It still upgrades away with the same core releases.

Affected versions and the fixed releases

Redis Cloud customers are already covered; Redis applied the fixes to its cloud builds and states no customer action is required. The population that must act is self managed Redis Software, OSS, and CE. Redis Software up to and including 8.0.6 is impacted unless already on a fixed build in the same line, and all Redis OSS and CE releases are impacted (Redis Security Advisory).

Versions above are quoted from the Redis Security Advisory; the RedisBloom boundary is corroborated by the NVD. Pick the fixed release on your current major line, so an 8.x core deployment moves to 8.6.3 and a 7.4 deployment moves to 7.4.9.

Figure 2: The fixed releases to upgrade to across core and modules. Source: Redis Security Advisory (May 5 2026).

Am I affected?

Work through this quickly. You are in scope if all or several of these are true:

• You self manage Redis Software, OSS, or CE rather than consuming Redis Cloud.

• Your Redis build is older than the fixed releases named above.

• You load the RedisBloom or RedisTimeSeries modules, which adds CVE-2026-25589 or CVE-2026-25588.

• Application service accounts or admins can call RESTORE, the pivot for three of the flaws.

• You run replicas with replica-read-only disabled, which adds the Lua flaw CVE-2026-23631.

Reachability still requires authenticated access, so an internet exposed Redis with weak or absent authentication is the worst case, because it shortens the distance to that authenticated foothold. Redis reported no evidence of exploitation as of the advisory, which is a reason to patch on a planned change window rather than in a panic, not a reason to defer (Redis Security Advisory).

Remediation checklist

This is remediation only. There are no exploit steps in this post.

1. Upgrade the core. Move Redis OSS or CE to the fixed release on your line: 6.2.22, 7.2.14, 7.4.9, 8.2.6, 8.4.3, or 8.6.3. Move Redis Software to 8.0.10-64, 7.22.2-79, 7.8.6-253, 7.4.6-279, or 7.2.4-153 (Redis Security Advisory).

2. Upgrade the modules too. If RedisBloom is loaded, reach v2.8.20, v2.6.28, or v2.4.23. If RedisTimeSeries is loaded, reach v1.12.14, v1.10.24, or v1.8.23. A core upgrade alone does not close the module CVEs.

3. Restrict RESTORE with ACLs. Grant RESTORE only to identities that genuinely need it, and remove it from application service accounts that do not. NVD notes ACL restriction of RESTORE as a temporary workaround for the RedisBloom case (NVD).

4. Constrain module loading. Limit who can load modules and audit which modules are actually loaded in production; unload modules you do not use.

5. Enforce strong authentication and protected mode. Require credentials for all access and keep protected mode enabled on CE and OSS, as the advisory recommends (Redis Security Advisory).

6. Segment Redis off the public internet. Put Redis behind firewalls and network policy so only trusted application tiers can reach it. An unreachable port is an unexploitable one.

7. Keep replica-read-only enabled unless you have a specific, reviewed reason to disable it, which narrows CVE-2026-23631.

8. Monitor for the advisory's indicators. Watch for access from unknown sources, anomalous ingress or egress, unexplained crashes with a Lua stack trace, and unexpected command execution or file system changes by the redis-server user (Redis Security Advisory).

Sidebar: the separate 27-minute AI discovery claim

This section is a clearly labelled, developing story. It is not the five patched CVEs above.

On July 23 2026, tech press reported that Moonshot AI's Kimi K3 autonomous agent had surfaced Redis class remote code execution paths in as little as 27 minutes (CyberPress). The reported findings, described with non destructive proofs of concept posted publicly, center on a stream consumer group shared NACK double free on stock builds including 6.2.22, 7.4.9, and 8.6.4, together with a heap overflow in the bundled RedisBloom TDigest path on 8.8.0, which one outlet frames as a CVE-2026-25589 incomplete fix family issue (Cybersecurity News). Coverage also notes the model's open weights were scheduled for public release on July 27 2026, which is the part that should hold a CISO's attention: once capable agents run privately, discovery pressure on widely deployed infrastructure rises.

Two cautions keep this honest. First, this is developing tech press with public proofs of concept, not a vendor advisory, and the specific findings had no confirmed separate CVE assignment as of this writing. Treat the 27 minute figure as a reported claim, not a settled benchmark. Second, and most important, this is not the same event as the May 2026 advisory. Some coverage has listed the five patched CVE identifiers directly under the Kimi K3 headline, which reads as if an AI found them. It did not. Redis's own advisory credits those five CVEs to named human researchers who reported them through its disclosure process (Redis Security Advisory). The autonomous agent story and the patched CVE story overlap only in that both concern Redis.

Figure 3: Two events, kept distinct. Left, the human reported and patched CVEs (May 5 2026). Right, the separate developing AI claim (July 23 2026). Source: Redis Security Advisory; CyberPress and Cybersecurity News.

What this means for defenders

The Redis advisory is a clean patch story: upgrade the core, upgrade the modules, tighten RESTORE and network exposure, and monitor. The Kimi K3 claim is the strategic signal underneath it. When an autonomous agent can plausibly surface RCE class paths in core infrastructure in minutes, and when the weights to run such agents privately are days from public release, point in time assurance stops being enough. The gap between a patch shipping and an attacker reaching an unpatched instance keeps shrinking.

That is why continuous, threat led validation is now table stakes rather than a nice to have. An annual test tells you about the day it ran; agentic red teaming and human led AI red teaming keep testing the paths that matter as your estate changes. For a datastore and infrastructure layer like Redis, the highest signal work stays with senior human pentesters, and with human led offensive security operations that reason about ACL design, RESTORE permissioning, module exposure, replication topology, and network segmentation, the exact factors that decide whether a post authentication flaw is reachable in your environment.

Stingrai, a CREST-accredited firm based in Canada, brings that combination. Our senior human pentesters and red team lead the datastore and infrastructure work, while our autonomous agent, Snipe, hunts the complex web application vulnerability classes that generic scanners miss: broken authorization, insecure direct object references, and business logic flaws. Snipe performs both black box dynamic testing and white box source review, opens AutoFix pull requests for what it finds, and can run as a pull request gating check so vulnerable code is caught before it merges. Together, continuous PTaaS coverage and threat led validation produce the evidence your SOC 2, ISO 27001, and PCI DSS programs rely on, and shorten the window an advisory like this one leaves open. See Stingrai pricing for how engagements are scoped.

Frequently Asked Questions

What are the 2026 Redis RCE CVEs?

The 2026 Redis RCE CVEs are CVE-2026-23479, CVE-2026-25243, CVE-2026-25588, CVE-2026-25589, and CVE-2026-23631, all patched by Redis on May 5 2026. Four are rated CVSS 7.7 High and the Lua flaw CVE-2026-23631 is rated 6.1 Medium; every one is a post authentication path that may lead to remote code execution (Redis Security Advisory).

Am I affected by the 2026 Redis CVEs?

You are affected if you self manage Redis Software, OSS, or CE on a build older than the fixed releases, especially with the RedisBloom or RedisTimeSeries modules loaded or with identities that can call RESTORE. Redis Cloud is already patched, so it requires no customer action (Redis Security Advisory).

Did an AI really find a Redis vulnerability in 27 minutes?

Tech press reported on July 23 2026 that Moonshot AI's Kimi K3 autonomous agent surfaced Redis class RCE paths in as little as 27 minutes, with public proofs of concept (CyberPress). That is a separate, developing story from the five May 2026 CVEs, which Redis credits to named human researchers, and it had no confirmed separate CVE assignment as of this writing.

What is CVE-2026-25589 in RedisBloom?

CVE-2026-25589 is an invalid memory access in the RedisBloom module when a crafted serialized payload is passed to the RESTORE command, which an authenticated attacker can steer toward remote code execution. NVD classifies it as a CWE-122 heap based buffer overflow and scores it CVSS v3.1 8.8 High for all RedisBloom versions before 2.8.20 (NVD).

Which Redis version fixes these CVEs?

For Redis OSS or CE, upgrade to 6.2.22, 7.2.14, 7.4.9, 8.2.6, 8.4.3, or 8.6.3 on your major line. For Redis Software, upgrade to 8.0.10-64, 7.22.2-79, 7.8.6-253, 7.4.6-279, or 7.2.4-153. Load fixed modules as well: RedisBloom v2.8.20 and RedisTimeSeries v1.12.14 on their current lines (Redis Security Advisory).

Is the Redis RESTORE command the main risk?

RESTORE is the common pivot for three of the five flaws: a crafted serialized payload passed to RESTORE reaches an invalid memory access in the core and in the RedisBloom and RedisTimeSeries modules. Restricting RESTORE to only the identities that need it, via ACL rules, is recommended as a temporary workaround alongside patching (NVD).

Are these Redis CVEs being exploited in the wild?

As of its advisory, Redis reported no evidence of exploitation of these vulnerabilities in its own or customer environments (Redis Security Advisory). That supports a planned change window for patching rather than an emergency response, but the flaws should still be closed promptly given they enable code execution.

How do I reduce Redis RCE risk beyond patching?

Beyond upgrading core and modules, restrict RESTORE and module loading with ACLs, enforce strong authentication and protected mode, segment Redis off the public internet behind firewalls, keep replica-read-only enabled, and monitor for anomalous access, crashes, and command execution by the redis-server user (Redis Security Advisory).

Who discovered the 2026 Redis CVEs?

Redis credits named independent researchers in its advisory, including Team Xint Code for CVE-2026-23479, Emil Lerner and Joseph Surin for CVE-2026-25243, Team Skateboarding Dog for CVE-2026-25588, Daniel Firer and Joseph Surin for CVE-2026-25589, and Yoni Sherez for CVE-2026-23631 (Redis Security Advisory). These are human researchers, not an AI agent.

Where can I get the official Redis advisory?

The primary source is the Redis security advisory published May 5 2026 (Redis Security Advisory). In Canada, the Canadian Centre for Cyber Security published the mirroring advisory AV26-423 the same day (Canadian Centre for Cyber Security), and the NVD entry for CVE-2026-25589 carries independent scoring (NVD).

References

1. Redis. Security advisory: CVE-2026-23479, CVE-2026-25243, CVE-2026-25588, CVE-2026-25589, CVE-2026-23631. May 5 2026. https://redis.io/blog/security-advisory-cve202623479-cve202625243-cve-2026-25588-cve202625589-cve-2026-23631/. Official advisory naming the five CVEs, CVSS ratings, affected and fixed versions for core and modules, remediation guidance, exploitation status, and the human researcher credits.

2. National Vulnerability Database (NIST). CVE-2026-25589 Detail. Retrieved July 2026. https://nvd.nist.gov/vuln/detail/CVE-2026-25589. Independent CVSS scoring (v3.1 8.8 High, v4.0 7.7 High), CWE-122 heap based buffer overflow classification, and the RedisBloom before 2.8.20 version boundary.

3. Canadian Centre for Cyber Security. Redis security advisory (AV26-423). May 5 2026. https://www.cyber.gc.ca/en/alerts-advisories/redis-security-advisory-av26-423. Canadian government mirror confirming the same five CVEs and advising administrators to apply the necessary updates.

4. CyberPress. Kimi K3 AI Agent Finds Redis RCE Vulnerabilities in Just 27 Minutes. July 23 2026. https://cyberpress.org/kimi-k3-ai-agent-finds-redis-rce-vulnerabilities/. Tech press coverage of the separate, developing autonomous agent claim, including the reported 27 minute figure and the open weights release date.

5. Cybersecurity News. New Kimi K3 AI Agent Uncovers 0-Day Exploits in Redis Server. July 23 2026. https://cybersecuritynews.com/redis-server-0-day-exploit/. Tech press coverage describing the reported stream NACK and RedisBloom TDigest findings and framing them as a developing, incomplete fix family issue.