Is Azure Cache for Redis 6.0 patched for CVE-2026-25243?

The redis_version:6.0.14 value does not establish whether CVE-2026-25243 is patched in Azure Cache for Redis; Microsoft must confirm remediation for your Premium cache, region, and deployed Azure build.

The upstream advisory places Redis 6.0.14 within the affected range for the RESTORE vulnerability ^1^. However, Azure Cache for Redis is managed and Microsoft deploys Redis server binary updates through service maintenance. Therefore, the upstream version reported by INFO cannot by itself prove either that the Azure build is vulnerable or that it contains a backported fix ^2^.

There is currently no conclusive public Microsoft answer confirming that CVE-2026-25243 has been remediated across Azure Cache for Redis 6.0 deployments; the CVE-specific Microsoft Q&A record has no accepted or recommended answer ^3^.

Obtain an authoritative status

In Azure portal → Help + support → Create a support request, open a Technical request for the affected Azure Cache for Redis resource. Ask Microsoft to confirm:

1. Whether CVE-2026-25243 applies to the Microsoft-managed Redis 6.0 build currently running on the cache.
2. Whether remediation has reached that specific Azure region and Premium instance.
3. Whether rollout is still in progress and its expected completion date.
4. Whether any customer action or maintenance event is required.
5. What evidence can be supplied for audit or vulnerability-management closure.

Include:

• Cache resource ID, SKU, region, and shard/replica configuration.
• The redis_version:6.0.14 output.
• The time and node from which it was collected.
• The CVE number and upstream advisory.
• Any compliance deadline requiring written confirmation.

Do not attempt to replace or patch Redis binaries yourself. Azure Cache for Redis does not provide host/OS access, and Redis server patches are applied by the service ^4^.

Risk reduction pending confirmation

These controls do not prove the CVE is remediated, but they reduce access to the cache:

• Use a private endpoint rather than exposing the cache through a public IP path.
• Restrict network access to only required application networks.
• Keep secure connections enabled and use TLS 1.2.
• Restrict credentials to trusted applications and rotate them if exposure is suspected.

Microsoft’s security baseline recommends Private Link and secure connections for Azure Cache for Redis ^4^. TLS is enabled by default, with TLS 1.2 recommended ^5^.

In short: upstream Redis 6.0.14 is in the affected range, but the displayed Azure version cannot determine Azure’s patch status. No public CVE-specific confirmation is currently available, so an Azure support case is required for an authoritative instance-level answer.

References

1. Security advisory: CVE‑2026‑23479 CVE‑2026‑25243 ...
2. Failover and patching - Azure Cache for Redis | Microsoft Learn
3. Cache for Redis: Critical security vulnerability CVE-2026-25243 ...
4. Azure security baseline for Azure Cache for Redis
5. Development