Exploited vulnerabilitiesBriefPublic record
Redis “RediShell” Lua use-after-free (CVE-2025-49844)
Disclosed 3 Oct 2025 (Wiz). CVSS 10. A 13-year-old bug.
- Disclosed
What happened
- Fixed: 8.2.2, 8.0.4, 7.4.6, 7.2.11, 6.2.20.
- Scale: about 330k internet-exposed instances, about 60k without authentication. Not in KEV.
Live scores
Live scores
CVE-2025-49844- EPSS
- 0.826
very likely to be attacked soon - VEDAS
- 0.987
strong exploit evidence - On CISA KEV
- Not listed
- Detection rule
- None yet
Sources
- https://www.wiz.io/blog/wiz-research-redis-rce-cve-2025-49844
- https://nvd.nist.gov/vuln/detail/CVE-2025-49844
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.