CVE-2026-66373Disclosure

MEDIUMCVSS 7.5 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch affected systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.

Back to dashboard

4.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-415

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
13 mentions across 7 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 1 signal
PoC mentioned or linked in 5 signals
Patch or workaround mentioned in 4 signals
Technical details provided in 10 signals
Disclosure: 4 classified signals
General: 3 classified signals
Peaked 6d ago at 4 mentions (2026-07-25); latest day: 1
13 total mentions across 7 days

Deep dive

Activity timeline13 mentions / 7d

Signal classification4 categories

Disclosure

433.3%

PoC

433.3%

General

325.0%

Patch

18.3%

Referenced assets9 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-25	4	Disclosure3Patch1
2026-07-26	1	Disclosure1
2026-07-27	1	PoC1
2026-07-30	3	PoC3
2026-07-31	2	General2
2026-08-01	1	General1

Full discourse13 posts

ZoomEye@zoomeye_team85d
General
🚨 CVE-2026-66373: Redis RESTORE Buffer Overflow Critical Vulnerability Alert! redis is affected by CVE-2026-66373. Full Vulnerability Details & Analysis at DarkEye: 🔗 https://darkeye.org/vuln/cve/CVE-2026-66373 🔍 Identify Targets via ZoomEye: Filter: vul.cve="CVE-2026-66373" Search Dork: service="redis" Exposure: 3.1m instances identified globally. ZoomEye Search Link: 👉 https://www.zoomeye.ai/searchResult?q=c2VydmljZT0icmVkaXMi&t=all&utm_source=twitter&utm_medium=social&utm_campaign=cve_ops_20260731 #Infosec #CyberSecurity #ZoomEye #DarkEye
Post summary
The tweet highlights a Redis RESTORE buffer overflow (CVE-2026-66373) and links to external analysis and a ZoomEye search, but provides no exploit code, patch details, or evidence of active exploitation.
110036103.8K
12.7K followersView on X
kokumօtօ@__kokumoto85d
PoC
Redisにおける遠隔コード実行の脆弱性CVE-2026-66373に対応するPoC（攻撃の概念実証コード）が公開された。RESTOREコマンドにおける二重解放の脆弱性で、CVE-2026-25243の修正不完全に起因するもの。CVSSスコア7.5。Redis 8.8.0（のみ）で修正。 https://securityonline.info/redis-rce-cve-2026-66373/
Post summary
A proof‑of‑concept has been released for Redis CVE‑2026‑66373, detailing a double‑free RCE in the RESTORE command, providing a CVSS rating, and noting the fix is only available in Redis 8.8.0.
1501121.3K
7.8K followersView on X
C2 Hunters Research@C2HuntersLabs4d
CVE-2026-66373 (Redis 8.6.4) confirmed exploited in the wild. Actor used a DEBUG-free, self-restoring RCE chain → dumped Redis cache creds → pivoted to DB → stole records → cleaned up their tracks. Patch: Redis 8.6.5 / 8.8.0 #cve-2026-66373 #CTI #RCE #redis
03072893
146 followersView on X
Daily CyberSecurity@Daily_CyberSec86d
PoC
A public PoC now targets CVE-2026-66373, a Redis RCE double-free via RESTORE. See affected versions and upgrade to Redis 8.8.0 now. #Redis #RedisRCE #CVE202666373 #RCE #DoubleFree #PoC #RESTORE #Cybersecurity http://securityonline.info/redis-rce-cve-2026-66373/
Post summary
A public Proof‑of‑Concept demonstrating a double‑free RCE in Redis via the RESTORE command for CVE‑2026‑66373 has been released, and users are urged to upgrade to Redis 8.8.0 to remediate the issue.
03011476
12.6K followersView on X
𝐑𝐀𝐢𝐡𝐚𝐧@zapstiko84d
General
🚨 CVE-2026-66373: Redis RESTORE Buffer Overflow Critical Vulnerability Alert! redis is affected by CVE-2026-66373. 🔍 Identify Targets via ZoomEye: Filter: vul.cve="CVE-2026-66373" Search Dork: service="redis" Exposure: 3.1m instances identified globally. ZoomEye Search Link: https://www.zoomeye.ai/searchResult?q=c2VydmljZT0icmVkaXMi&t=all&utm_source=twitter&utm_medium=social&utm_campaign=cve_ops_20260731
Post summary
The post alerts about CVE-2026-66373, a Redis RESTORE buffer overflow, and shares a ZoomEye search link to locate affected instances.
01012397
7.6K followersView on X
CERT-PY@CERTpy84d
General
⚠️ Vulnerabilidad en productos Redis ❗ CVE-2026-66373 ➡️ Más info: https://www.cert.gov.py/vulnerabilidad-en-productos-redis/ https://t.co/ljbIxgv5Xq
Post summary
The tweet announces CVE‑2026‑66373, a vulnerability in Redis products, and points to an external link for more information, but provides no further details.
00001235
6.7K followersView on X
PJ@Npj844890d
Disclosure
Vulnerabilities in products from vendors like Redis, Knot Resolver, and WPForms Pro were identified, including CVE-2026-66373, CVE-2026-66374, and CVE-2026-10818, which could be exploited for remote code execution or arbitrary file upload. #cve
Post summary
The message announces three new CVEs (CVE-2026-66373, CVE-2026-66374, CVE-2026-10818) affecting Redis, Knot Resolver, and WPForms Pro, noting risks of remote code execution or arbitrary file upload.
1000057
50 followersView on X
moton@moton86d
PoC
CVE-2026-66373: Redis RCE PoC Publicly Disclosed - https://securityonline.info/redis-rce-cve-2026-66373/
Post summary
The text announces that a PoC for CVE-2026-66373, a Redis remote code execution vulnerability, has been publicly disclosed and linked, but no exploit or mitigation details are provided.
00000100
718 followersView on X
Hephaestvs@Vulcanux_88d
PoC
csirt_it: ‼ #Redis: disponibile un #PoC per lo sfruttamento della CVE-2026-66373 Rischio: 🔴 Tipologia: 🔸 Remote Code Execution 🔸Denial of Service 🔗 https://www.acn.gov.it/portale/w/redis-poc-pubblico-per-lo-sfruttamento-della-cve-2026-66373 ⚠ Importante mantenere aggiornati i sistemi https://t.co/XokmRM3bIl
Post summary
A public PoC demonstrating Remote Code Execution and DoS capabilities for CVE‑2026‑66373 in Redis is shared, with an advisory to keep systems patched.
0000042
621 followersView on X
Upwind Security MDR@UpwindMDR91d
Patch
🚨High - Redis Double-Free RCE via RESTORE and XGROUP DELCONSUMER (CVE-2026-66373) In Redis before 8.8.0, an authenticated attacker able to run RESTORE can supply a payload where the same stream NACK (pending entry) is referenced by more than one consumer. Deleting both consumers with XGROUP DELCONSUMER then triggers a double free, corrupting the heap and enabling remote code execution. The bug exists because of an incomplete fix for CVE-2026-25243, and a public PoC is available. Exploitation requires an authenticated client with access to RESTORE and has high attack complexity, so hardened, ACL-restricted deployments are less exposed. CVSS 7.5. 👉Upgrade Redis to 8.8.0. Where you can't patch, restrict RESTORE and stream commands via ACLs for low-trust clients.
Post summary
Redis versions before 8.8.0 suffer a double-free RCE (CVE‑2026‑66373). A public PoC exists; users should upgrade to 8.8.0 or apply ACL restrictions to mitigate the risk.
0000094
254 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds91d
Disclosure
CVE-2026-66373 Remote Code Execution in Redis Before 8.8.0 via RESTORE Double Free https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-66373
Post summary
The post announces CVE‑2026‑66373, a Remote Code Execution vulnerability in Redis versions prior to 8.8.0 caused by a double free in the RESTORE command, with no PoC, exploit, or patch details provided.
00000112
4.1K followersView on X
Infoflowcloud@infoflowcloud91d
Disclosure
🚨*CVE* CVE-2026-66373 Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (p… https://www.cve.org/CVERecord?id=CVE-2026-66373 ----- Traducción: CVE-2026-66373 Red… http://infoflow.cloud`
Post summary
A new CVE-2026-66373 affecting Redis before 8.8.0 is disclosed, revealing that an authenticated attacker can exploit the RESTORE command to achieve remote code execution; no PoC, exploit code, active exploitation claim, patch, or debunking is mentioned.
0000033
95 followersView on X
CVE@CVEnew91d
Disclosure
CVE-2026-66373 Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (p… https://www.cve.org/CVERecord?id=CVE-2026-66373
Post summary
The post briefly announces CVE‑2026‑66373, noting a remote code execution flaw in Redis prior to version 8.8.0 that involves an authenticated RESTORE payload, but provides no PoC, exploit, or patch details.
000001.4K
57.9K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-66373

ZoomEye[verified]@zoomeye_teamGeneral

The tweet highlights a Redis RESTORE buffer overflow (CVE-2026-66373) and links to external analysis and a ZoomEye search, but provides no exploit code, patch details, or evidence of active exploitation.

kokumօtօ[verified]@__kokumotoPoC

A proof‑of‑concept has been released for Redis CVE‑2026‑66373, detailing a double‑free RCE in the RESTORE command, providing a CVSS rating, and noting the fix is only available in Redis 8.8.0.

𝐑𝐀𝐢𝐡𝐚𝐧[verified]@zapstikoGeneral

The post alerts about CVE-2026-66373, a Redis RESTORE buffer overflow, and shares a ZoomEye search link to locate affected instances.

Upwind Security MDR[verified]@UpwindMDRPatch

Redis versions before 8.8.0 suffer a double-free RCE (CVE‑2026‑66373). A public PoC exists; users should upgrade to 8.8.0 or apply ACL restrictions to mitigate the risk.

Daily CyberSecurity@Daily_CyberSecPoC

A public Proof‑of‑Concept demonstrating a double‑free RCE in Redis via the RESTORE command for CVE‑2026‑66373 has been released, and users are urged to upgrade to Redis 8.8.0 to remediate the issue.

CERT-PY@CERTpyGeneral

The tweet announces CVE‑2026‑66373, a vulnerability in Redis products, and points to an external link for more information, but provides no further details.

PJ@Npj8448Disclosure

The message announces three new CVEs (CVE-2026-66373, CVE-2026-66374, CVE-2026-10818) affecting Redis, Knot Resolver, and WPForms Pro, noting risks of remote code execution or arbitrary file upload.

moton@motonPoC

The text announces that a PoC for CVE-2026-66373, a Redis remote code execution vulnerability, has been publicly disclosed and linked, but no exploit or mitigation details are provided.