# redis vulnerabilities & exploitation **CISA KEV** · **Ransomware** > As of 2026-10-10, Threadlinqs tracks 7 redis CVEs, 1 in the CISA Known Exploited Vulnerabilities catalog, 1 used in ransomware campaigns, linked to 7 tracked threat campaigns and 1 named threat actor. **Data as of:** 2026-10-10 ## Exploitation timeline Threadlinqs has recorded 7 redis CVEs published between 2022-02-15 and 2026-08-15. The busiest month was 2026-05 (3 new CVEs). 1 of them (14%) are listed in CISA KEV, which means exploitation in the wild has been confirmed. ## Most exploited vulnerabilities Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 7 of 7 tracked redis CVEs. - [CVE-2022-0543](https://intel.threadlinqs.com/cve/CVE-2022-0543) — CRITICAL 10 · KEV · Ransomware · EPSS 99.4% · 2022-02-18 - [CVE-2025-49844](https://intel.threadlinqs.com/cve/CVE-2025-49844) — CRITICAL 10 · EPSS 82.3% · 2025-10-03 - [CVE-2025-62507](https://intel.threadlinqs.com/cve/CVE-2025-62507) — HIGH 8.8 · EPSS 6.8% · 2025-11-04 - [CVE-2026-25243](https://intel.threadlinqs.com/cve/CVE-2026-25243) — HIGH 8.8 · EPSS 3.7% · 2026-05-05 - [CVE-2026-23631](https://intel.threadlinqs.com/cve/CVE-2026-23631) — HIGH 8.8 · EPSS 2.8% · 2026-05-05 - [CVE-2026-23479](https://intel.threadlinqs.com/cve/CVE-2026-23479) — HIGH 7.5 · EPSS 1.5% · 2026-05-05 - [CVE-2026-81934](https://intel.threadlinqs.com/cve/CVE-2026-81934) — CRITICAL 9.8 · EPSS 0.6% · 2026-08-27 ## Products affected Threadlinqs normalises CPE and CNA product records across all 7 CVEs; 1 distinct redis product is affected. The most frequently affected: - Redis — 7 CVEs ## Threat activity 7 tracked threat campaigns reference redis products or exploit redis CVEs: - [CyberXero: AI-Augmented Initial Access Broker Targeting Ukrainian Critical Infrastructure and Global WordPress/E-commerce Platforms](https://intel.threadlinqs.com/threat/TL-2026-2992) — HIGH — 2026-10-07 - [Redis Streams Shared-NACK Double-Free (CVE-2026-25243) & RedisBloom RESTORE/TDigest Heap Overflow (CVE-2026-25589) — Authenticated RCE, Public PoC, Patch Bypass](https://intel.threadlinqs.com/threat/TL-2026-1690) — HIGH — 2026-07-23 - [CVE-2025-62507: Unauthenticated Stack-Based Buffer Overflow RCE in Redis XACKDEL Command](https://intel.threadlinqs.com/threat/TL-2026-1537) — HIGH — 2026-07-19 - [Redis DarkReplica (CVE-2026-23631) — Post-Auth RCE via Lua Functions-Engine Use-After-Free During Master-Replica Sync](https://intel.threadlinqs.com/threat/TL-2026-0713) — HIGH — 2026-06-08 - [Redis RCE CVE-2026-23479 — Use-After-Free in unblockClientOnKey() (Authenticated, CVSS 8.8)](https://intel.threadlinqs.com/threat/TL-2026-0682) — HIGH — 2026-06-04 - [P2Pinfect Kubernetes Compromise — Exposed Redis Enables Persistent GKE Botnet Enrollment with Six-Month Dormancy (CVE-2022-0543, CVE-2025-11953, CVE-2025-49844)](https://intel.threadlinqs.com/threat/TL-2026-0537) — HIGH — 2026-05-21 - [PCPJack Worm — Cloud Credential Theft Framework Evicting TeamPCP Infections (CVE-2025-29927, CVE-2025-55182, CVE-2026-1357, CVE-2025-9501, CVE-2025-48703)](https://intel.threadlinqs.com/threat/TL-2026-0478) — CRITICAL — 2026-05-07 ## Threat actors targeting redis Named threat actors attributed to campaigns that involve redis products or CVEs, with the number of linked campaigns: - [PCPJack](https://intel.threadlinqs.com/actor/PCPJack) — 1 campaign ## How to prioritise redis patching This order follows the data Threadlinqs holds for redis, not a generic severity checklist: - 1 of 7 redis CVEs (14%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with [CVE-2022-0543](https://intel.threadlinqs.com/cve/CVE-2022-0543). - 1 CVE is known to be used in ransomware campaigns; patch these ahead of other KEV entries on internet-facing systems. - Outside KEV, the highest EPSS scores are [CVE-2025-49844](https://intel.threadlinqs.com/cve/CVE-2025-49844) (82.3%), [CVE-2025-62507](https://intel.threadlinqs.com/cve/CVE-2025-62507) (6.8%), [CVE-2026-25243](https://intel.threadlinqs.com/cve/CVE-2026-25243) (3.7%). - 3 CVEs score Critical and 4 High on CVSS v3 (maximum 10, average 9.1); sequence these after KEV and high-EPSS items. - 6 CVEs have a public exploit or proof of concept recorded, which shortens the time from disclosure to attack. ## About this data Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-10 and refresh daily. Canonical: https://intel.threadlinqs.com/vendors/redis All vendors: https://intel.threadlinqs.com/vendors Full detection coverage and IOCs via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp