CVE-2026-66373
⚠️ highSummary
Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.
CVSS Score
7.5
High
EPSS Score
0.5
Exploit Probability
Published Date
2026-07-25
First Seen: 2026-07-31
📊 Relative Risk Intelligence
This CVE is Moderate Risk - more severe than 68.5% of all 340,405 vulnerabilities in our database.
#107,108
Above average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Jul 27, 2026
🔍 Exploitation Status
Poc
Proof-of-concept available
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Total
Complete system compromise possible
SSVC data provided by
CISA
Last Modified
2026-07-28
Source
NVD 🔗
CVSS Vector 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE IDs (Weakness Types)