RediShell RCE Vulnerability Exposes 8,500+ Redis Instances to Code Execution Attacks
The cybersecurity landscape faced a critical threat in early October 2025 with the public disclosure of RediShell, a severe use-after-free vulnerability in Redis’s Lua scripting engine.
The cybersecurity landscape faced a critical threat in early October 2025 with the public disclosure of RediShell, a severe use-after-free vulnerability in Redis’s Lua scripting engine.
Identified as CVE-2025-49844 and dubbed “RediShell” by Wiz researchers, this flaw enables attackers to escape the Lua sandbox restrictions and achieve host-level remote code execution on vulnerable systems.
RediShell RCE vulnerability (Source – CriminalIP) The vulnerability stems from cumulative flaws within Redis’s core architecture, affecting installations dating back to around 2012 when the vulnerable code path was initially introduced.
The attack surface proved immediately extensive and concerning. Criminalip analysts identified over 8,500 Redis instances worldwide that remain vulnerable to exploitation as of October 27, 2025.
These instances are directly exposed to the public internet, creating a critical window of opportunity for threat actors employing automated scanning techniques.
In environments where authentication mechanisms remain disabled—a surprisingly common configuration for development and legacy deployments—attackers can deliver malicious Lua scripts without any credential requirements, dramatically lowering the barrier to successful exploitation.
The global distribution of affected systems reveals troubling concentrations in specific regions.
CriminalIP researchers noted that the United States harbors the largest number of vulnerable instances with 1,887 cases, followed by France with 1,324 and Germany with 929 instances, collectively representing over 50 percent of total worldwide exposure.
Criminalip analysts identified over 8,500 Redis instances worldwide that remain vulnerable to exploitation as of October 27, 2025.
This geographical clustering suggests either deliberate targeting of specific infrastructure hubs or widespread adoption of unpatched Redis instances across enterprise environments in these regions.
Sandbox Escape and Exploitation Mechanics
The technical foundation of RediShell centers on manipulating Redis’s garbage collection behavior through specially crafted Lua scripts.
An attacker sends a malicious script targeting the use-after-free condition, allowing the script to escape the confines of the Lua sandbox environment.
Once outside the sandbox, the script achieves arbitrary native code execution with the privileges of the Redis process.
The exploitation sequence typically begins with initial compromise through the malicious Lua delivery, followed by sandbox escape, installation of reverse shells or backdoors for persistent access, and subsequent credential theft to facilitate lateral movement across the broader infrastructure.
The vulnerability transforms what appears to be a data caching service into a complete entry point for host compromise.
Organizations operating affected Redis instances without proper authentication or network segmentation face immediate risk of full infrastructure takeover, data exfiltration, and deployment of secondary payloads including cryptominers and ransomware.
AttributeDetailsCVE IdentifierCVE-2025-49844Vulnerability TypeUse-After-Free Memory CorruptionAffected ComponentRedis Lua Scripting EngineSeverityCriticalCVSS Score9.8 (Network-based, requiring no authentication)Vulnerable VersionsRedis 8.2.1 and earlierAttack VectorNetwork, unauthenticatedPublic DisclosureEarly October 2025Exposed Instances8,500+ globallyExploitation MethodMalicious Lua script deliveryImpactHost-level Remote Code Execution Immediate patching remains the absolute priority. Organizations should upgrade to patched Redis versions immediately as recommended in official security advisories.
For environments where patching faces delays, enabling authentication through AUTH or ACL configurations, restricting network access to port 6379, and disabling Lua execution commands like EVAL and EVALSHA provide interim protection layers.
Continuous monitoring through threat intelligence platforms remains essential for detecting both exposure and exploitation attempts across infrastructure.
Follow us on Google News , LinkedIn , and X to Get More Instant Updates , Set CSN as a Preferred Source in Google .
Based on reporting by Cyber Security News.