Vulnerability intelligence
CVE-2025-8088
RARLAB WinRAR Path Traversal Vulnerability
A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET.
CVSS Score
8.4
High
EPSS — Exploit Probability
95%
Riskier than 100% of all CVEs · checked 2026-10-17
Exploitation
Confirmed in the wild
Used in ransomware campaigns
Remediation
Patch available
Federal deadline 2025-09-02
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2025-09-02.
22 articles across 9 outlets · first covered Jun 1, 2026 · latest Oct 16, 2026
Associated threat actors
Coverage timeline
-
Espionage Group Exploits WinRAR Flaw to Target CIS Governmentssecurityonline.info · Oct 16, 2026
-
Kazakhstan Based Espionage Group Exploits CVE to Target Energy and Governmentsecurityaffairs.com · Oct 15, 2026
-
Silent Lynx Exploits WinRAR Flaw in Attacks on CIS Governmentsthehackernews.com · Oct 15, 2026
-
STOCKSTAY malware hits Ukraine, Italy via phishing RDP exploitssecurityonline.info · Jun 30, 2026
-
WinRAR Flaw CVE-2025-8088 Hits Ukrainian Firms Despite Patchsecurityonline.info · Jun 15, 2026
-
Russian APTs exploit WinRAR flaw CVE-2025-8088 to target Ukrainesecurityaffairs.com · Jun 10, 2026
-
Russian Attackers Weaponize WinRAR Flaw Against Ukrainian Orgswww.darkreading.com · Jun 9, 2026
-
Gamaredon Uses WinRAR Vulnerability to Launch Modular Spy Campaign on Ukrainian Targetssecurityaffairs.com · Jun 4, 2026
-
Ukrainian networks hit by stealth Gamaredon worm via WinRAR flawwww.infosecurity-magazine.com · Jun 1, 2026
-
Q4 2025 Exploits Hit Windows and Linux, Spotlight CVE-2025-55182securelist.com · Mar 6, 2026
-
Kali Linux integrates Anthropic Claude AI to speed cyber attacksthehackernews.com · Feb 26, 2026
-
Google: WinRAR CVE-2025-8088 abused by state actors to persistcloud.google.com · Feb 25, 2026
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 83securityaffairs.com · Feb 8, 2026
-
China-linked Amaranth-Dragon hackers target Southeast Asian governments in 2025securityaffairs.com · Feb 5, 2026
-
10 Days to Exploit: Amaranth-Dragon Weaponizes WinRAR Flaw to Spy on SE Asiasecurityonline.info · Feb 5, 2026
-
China-Linked Amaranth-Dragon Exploits WinRAR Flaw in Espionage Campaignsthehackernews.com · Feb 4, 2026
-
Amaranth-Dragon: Weaponizing CVE-2025-8088 for Targeted Espionage in the Southeast Asiaresearch.checkpoint.com · Feb 4, 2026
-
Nation-state and criminal actors leverage WinRAR flaw in attackssecurityaffairs.com · Jan 29, 2026
-
The “Zeroplayer” Arsenal: WinRAR Flaw CVE-2025-8088 Weaponized by Spiessecurityonline.info · Jan 29, 2026
-
Months After Patch, WinRAR Bug Poised to Hit SMBs Hardestwww.darkreading.com · Jan 28, 2026
-
Google Warns of Active Exploitation of WinRAR Vulnerability CVE-2025-8088thehackernews.com · Jan 28, 2026
-
APTs, Cybercriminals Widely Exploiting WinRAR Vulnerabilitywww.securityweek.com · Jan 28, 2026