Exploitation timeline
Threadlinqs has recorded 7 redis CVEs published between and . The busiest month was 2026-05 (3 new CVEs). 1 of them (14%) are listed in CISA KEV, which means exploitation in the wild has been confirmed.
Most exploited vulnerabilities
Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 7 of 7 tracked redis CVEs.
- CVE-2022-0543critical 10KEVRansomwareEPSS 99.4%
- CVE-2025-49844critical 10EPSS 82.3%
- CVE-2025-62507high 8.8EPSS 6.8%
- CVE-2026-25243high 8.8EPSS 3.7%
- CVE-2026-23631high 8.8EPSS 2.8%
- CVE-2026-23479high 7.5EPSS 1.5%
- CVE-2026-81934critical 9.8EPSS 0.6%
Products affected
Threadlinqs normalises CPE and CNA product records across all 7 CVEs; 1 distinct redis product is affected. The most frequently affected:
- Redis 7 CVEs
Threat activity
7 tracked threat campaigns reference redis products or exploit redis CVEs:
- CyberXero: AI-Augmented Initial Access Broker Targeting Ukrainian Critical Infrastructure and Global WordPress/E-commerce PlatformsHIGH
- Redis Streams Shared-NACK Double-Free (CVE-2026-25243) & RedisBloom RESTORE/TDigest Heap Overflow (CVE-2026-25589) — Authenticated RCE, Public PoC, Patch BypassHIGH
- CVE-2025-62507: Unauthenticated Stack-Based Buffer Overflow RCE in Redis XACKDEL CommandHIGH
- Redis DarkReplica (CVE-2026-23631) — Post-Auth RCE via Lua Functions-Engine Use-After-Free During Master-Replica SyncHIGH
- Redis RCE CVE-2026-23479 — Use-After-Free in unblockClientOnKey() (Authenticated, CVSS 8.8)HIGH
- P2Pinfect Kubernetes Compromise — Exposed Redis Enables Persistent GKE Botnet Enrollment with Six-Month Dormancy (CVE-2022-0543, CVE-2025-11953, CVE-2025-49844)HIGH
- PCPJack Worm — Cloud Credential Theft Framework Evicting TeamPCP Infections (CVE-2025-29927, CVE-2025-55182, CVE-2026-1357, CVE-2025-9501, CVE-2025-48703)CRITICAL
Threat actors targeting redis
Named threat actors attributed to campaigns that involve redis products or CVEs, with the number of linked campaigns:
How to prioritise redis patching
This order follows the data Threadlinqs holds for redis, not a generic severity checklist:
- 1 of 7 redis CVEs (14%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with CVE-2022-0543.
- 1 CVE is known to be used in ransomware campaigns; patch these ahead of other KEV entries on internet-facing systems.
- Outside KEV, the highest EPSS scores are CVE-2025-49844 (82.3%), CVE-2025-62507 (6.8%), CVE-2026-25243 (3.7%).
- 3 CVEs score Critical and 4 High on CVSS v3 (maximum 10, average 9.1); sequence these after KEV and high-EPSS items.
- 6 CVEs have a public exploit or proof of concept recorded, which shortens the time from disclosure to attack.
About this data
Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-10 and refresh daily.