Cache for Redis: Critical security vulnerability CVE-2026-25243 — Remediation status

Hi Abhilash-9163

You are correct CVE-2026-25243 is a confirmed Redis vulnerability affecting the RESTORE command. An authenticated attacker with permission to execute this command may trigger memory corruption and potentially remote code execution.

Redis published security fixes on May 5, 2026, covering multiple Redis versions. Additionally, the Canadian Centre for Cyber Security reported evidence of active exploitation on October 19, 2026.

Official Redis security advisory

Both are Microsoft-managed services. Microsoft handles Redis engine security patches automatically, so customers cannot manually install these fixes.
A similar Microsoft Q&A discussion confirms that Microsoft manages Redis security patching and that a support request is the appropriate way to obtain instance-specific confirmation.

Microsoft documentation: Azure Managed Redis patching

I would recommend:

1. Check maintenance history in Azure Activity Log and review Azure Service Health for relevant notifications. Note that maintenance events alone do not prove a specific CVE was fixed.
2. Reduce exposure: use Private Endpoints, TLS, and least-privilege authentication. Where supported, restrict the RESTORE command using Redis ACLs.
3. Open an Azure Support request and ask Microsoft to confirm the patch status for your specific Redis resources.

Also I recommend including this question in the support request:

Can you confirm whether CVE-2026-25243 has been fully remediated for our Azure Cache for Redis and Azure Managed Redis instances, including the deployed patched build, remediation date, and whether any customer action is required?

Provide the resource IDs, regions, SKUs, and Redis versions privately.