CVE-2026-75854: ArcadeDB Redis Wire-Protocol Plugin Missing Authentication

Overview

CVE-2026-75854 affects the Redis wire-protocol plugin of ArcadeDB, a database product from ArcadeData. According to the record, versions before 26.8.1 accept Redis-protocol connections without requiring authentication, which is classified as CWE-306 (Missing Authentication for Critical Function). VulnCheck published the record as the CNA, with the NVD entry and CVE Record pages also listed.

Impact

• The record states that unauthenticated attackers can read, write and delete data.
• The record states that commands can be run against any database on the server without credentials.
• VulnCheck rates the CVSS 3.1 base score at 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes network reach, no privileges required, no user interaction, and high impact to confidentiality, integrity and availability.
• A CVSS 4.0 score of 9.3 also appears in the record.

Affected products and versions

• Product: ArcadeData Arcadedb, versions less than 26.8.1.
• The record lists no explicit fixed version. The upper bound of the affected range suggests 26.8.1 is the first unaffected release, which is an inference to confirm against the vendor advisory.

Exploitation status

• This CVE is not listed in the CISA KEV catalog in the record, so active exploitation is not confirmed by that source.
• The SSVC exploitation value in the record is poc, which indicates proof-of-concept material may be available. This is not evidence of exploitation in the wild.
• No confirmed exploitation appears in the sources consulted.
• The EPSS probability is 0.00887 with a percentile of 0.5823 in the record.

Remediation and mitigation

• Plan an upgrade of ArcadeDB to version 26.8.1 or later, and confirm the correct release in the vendor advisory.
• If an upgrade cannot be applied immediately, restrict network access to the Redis-compatible port to trusted hosts only.
• Do not expose database service ports directly to untrusted networks.
• If the Redis plugin is not needed, consider disabling it as a temporary measure.

Detection guidance

• Inventory ArcadeDB instances, their versions, and whether the Redis-compatible listener is enabled.
• Review network logs for connections to that port from unexpected sources.
• Check for unexpected data modification or deletion, and confirm that backups are current and restorable.

Limitations of the available information

• The record does not state an explicit fixed version.
• The record does not describe default plugin configuration or whether the listener is enabled by default.
• Only the CVSS 4.0 score is given, without its vector string.
• The source status is Deferred, and the linked vendor advisory content was not part of the record.
• The EPSS date (2026-10-13) is later than the publication date (2026-08-18), so the EPSS figures should be interpreted with caution.

Frequently asked questions

Which ArcadeDB versions are affected by CVE-2026-75854?

The record lists ArcadeData Arcadedb versions less than 26.8.1 as affected. Confirm the exact scope in the vendor advisory.

Is this vulnerability known to be exploited in the wild?

The record does not list this CVE in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. The SSVC value poc suggests proof-of-concept material may exist.

What should administrators do now?

Plan an upgrade to 26.8.1 or later, restrict network access to the Redis-compatible port to trusted hosts, avoid direct internet exposure, and review logs and backups for unexpected changes.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.