Memcached - A Story of Failed Patching & Vulnerable Servers

Summary: Cisco Talos reported CVE-2016-8704, a memcached vulnerability patched by the vendor and released publicly on October 31, which major Linux distributions backported without changing the server's version number. A follow-up Internet scan found 73,403 memcached servers (about 69%) still vulnerable, and of the 18,173 servers requiring authentication, 18,012 (about 99%) were still vulnerable.
Bottom line: Roughly 69% of scanned memcached servers remained exposed after a patch was available, and backported fixes that kept version numbers unchanged make patched and unpatched hosts look identical to anyone checking versions alone.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2016-8704
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026