Redis released emergency patches on July 23 following the disclosure of zero-day remote code execution vulnerabilities affecting versions 6.2.22, 7.4.9, 8.6.4, and 8.8.0. Researchers identified memory corruption flaws that attackers can chain together to achieve RCE on authenticated Redis instances.
The exploitation chains require the RESTORE command. Two separate chains additionally demand EVAL and XGROUP commands, while an 8.8.0-specific chain requires EVAL and the RedisBloom module. Redis classified these as memory safety issues with RCE potential, prompting the vendor to release seven patches across versions 6.2.23, 7.2.15, and 7.4.10.
The vulnerability stems from what researchers describe as "Kimi K3 Agents" discovering and weaponizing these flaws. The attack surface remains limited to authenticated connections, meaning attackers need valid credentials or network access to exposed Redis instances. This significantly reduces risk in properly segmented environments where Redis runs behind authentication and firewalls.
Redis deployments commonly run as cache layers or session stores in production environments, handling sensitive application data. Successful exploitation grants attackers command execution within the context of the Redis process, potentially exposing cached data or enabling lateral movement into backend systems.
Organizations running affected Redis versions should prioritize patching immediately. This applies particularly to systems exposed across untrusted networks or those sharing credentials with developers or contractors. Internal deployments with strong network segmentation present lower immediate risk, though patching remains essential.
The rapid disclosure and patch cycle suggests researchers exercised responsible vulnerability disclosure. Redis took action within weeks of learning of the flaws, minimizing the window where active exploits could circulate unpatched. However, the existence of reliable RCE chains means defenders should assume threat actors will develop or obtain working