KEV Intelligence

Vulnerability report

Exploited in the wild Confirmed confidence In CISA KEV

CVE-2025-8088

Path traversal vulnerability in WinRAR

win.rar GmbH / WinRAR · 0 to <= 7.12

View live feed Monitor via API Watch CVE
Severity
CVSS 8.4 · High
Confidence
Confirmed
Exploit status
Exploited in the wild
EPSS
94.6%
First observed
—
Last observed
—

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2025-8088 is an unauthenticated Path traversal vulnerability in WinRAR. A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious...

Is it exploited?

Yes. KEV Intelligence tracks this CVE as a known exploited vulnerability. Confidence is confirmed.

Who is affected?

win.rar GmbH / WinRAR 0 to <= 7.12.

What should we do?

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

Overview

Path traversal vulnerability in WinRAR

A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files.

This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET.

Vendor Product Affected Status
win.rar GmbH WinRAR Through 7.12 Affected
Published
08 Aug 2025
Exploitation Reported
01 Jun 2026
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
—

Tags

cisa windows

CVE References

  • CVE Record CVE.org · CVE Record https://www.cve.org/CVERecord?id=CVE-2025-8088
  • win-rar.com/singlenewsview.html win-rar.com · CVE Record https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%...

Exploitation evidence

Why KEV Intelligence marks this CVE as exploited

Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.

Exploited in the wild

CVE

Recorded 01 Jun 2026

Independent exploitation attestation added to the KEV Intelligence record.

Known exploited vulnerability sources

Per-source evidence links for KEV attestations are available through the KEV Intelligence Pro API.

Learn about Pro API access
Source Added
CVE First 2026-06-01 10:38 UTC
CISA 2026-06-02 14:06 UTC
TheHackerNews 2026-06-09 13:20 UTC

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Observed signals

Request targets
0
User-Agents
0

Raw values available in Pro and Enterprise.

Scanner coverage

No scanner integrations recorded yet.

Virtual patch status

No KEV Intelligence virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.

Learn about virtual patches →

No detection artifacts or sensor request patterns are available for this CVE yet.

Check back as sensor telemetry and scanner integrations are updated.

Risk and context

Severity, weaknesses, and research context

CVSS v4.0

8.4 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS

94.6%

Weaknesses

Path Traversal: '.../...//' CWE-35

Recent mention · Google Threat Intelligence

Written by: Jordan Jones Introduction  Google Threat Intelligence Group (GTIG) has conducted an in-depth analysis of a .NET backdoor, tracked as...

Written by: Jordan Jones Introduction  Google Threat Intelligence Group (GTIG) has conducted an in-depth analysis of a .NET backdoor, tracked as STOCKSTAY, that has been continually developed and deployed by the Russia-linked threat actor Turla (aka SUMMIT, Secret Blizzard,...

Read full advisory

All CVSS Scores

CVSS v4.0 8.4 High

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS v3.1 8.8 High

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

All Mentions

Recent mention · Google Threat Intelligence

Written by: Jordan Jones Introduction  Google Threat Intelligence Group (GTIG) has conducted an in-depth analysis of a .NET backdoor, tracked as...

Google Threat Intelligence · 25 Jun 2026

Written by: Jordan Jones Introduction  Google Threat Intelligence Group (GTIG) has conducted an in-depth analysis of a .NET backdoor, tracked as STOCKSTAY, that has been continually developed and deployed by the Russia-linked threat actor Turla (aka SUMMIT, Secret Blizzard, VENOMOUS BEAR, UAC-0194) since at least December 2022. Turla has deployed STOCKSTAY against government and military organizations in Ukraine, as well as entities with an interest in Italian foreign policy. Used for ongoing cyber espionage, this backdoor shares significant code and functional overlaps with KAZUAR, a...

Recent mention · Daily CyberSecurity

Old WinRAR Flaw Still Fuels Attacks on Ukraine in 2026

Daily CyberSecurity · 15 Jun 2026

A Patched Flaw That Refuses to Die Nearly a year after a fix shipped, the WinRAR vulnerability Russia-aligned The post Old WinRAR Flaw Still Fuels Attacks on Ukraine in 2026 appeared first on Daily CyberSecurity. Related posts: Beyond the Inbox: How a Cyber-Espionage Group Is Exploiting Two WinRAR Vulnerabilities The “Zeroplayer” Arsenal: WinRAR Flaw CVE-2025-8088 Weaponized by Spies Anatomy of an Attack: New Report Exposes Ukrainian Networks Fueling Global Brute-Force Campaigns

Recent mention · Dark Reading

Russian Attackers Weaponize WinRAR Flaw Against Ukrainian Orgs

Dark Reading · 09 Jun 2026

Two separate campaigns target CVE-2025-8088, fixed last July, to conduct data theft and cyberespionage against military and government targets in Ukraine.

Recent mention · TheHackerNews

WinRAR Flaw Exploited by Russia-Aligned Groups to Deploy Stealers in Ukraine

TheHackerNews · 09 Jun 2026

Two Russia-aligned cyber attack campaigns have continued to exploit a security flaw in WinRAR to target Ukrainian organisations, almost a year after patches for the vulnerability were released. The activity has been attributed by Trend Micro to Earth Dahu (aka Gamaredon) and SHADOW-EARTH-066 (aka UAC-0226). It involves the exploitation of CVE-2025-8088, a path traversal flaw that allows an

Recent mention · TheHackerNews

Gamaredon Exploits WinRAR to Deliver GammaWorm and GammaSteel Against Ukraine

TheHackerNews · 02 Jun 2026

The Russian hacking group known as Gamaredon has been attributed to the continued exploitation of a WinRAR vulnerability to deliver multiple malware families aimed at data theft and propagation. Per Sekoia, the activity involves the weaponization of CVE-2025-8088, a path traversal flaw in WinRAR, to launch an HTML Application payload dubbed GammaPhish, which is then used to retrieve an

Timeline

From disclosure to observed exploitation

  1. KEV confirmed by TheHackerNews

    Exploitation attested by an external source

  2. Added to CISA KEV

    Listed in the CISA Known Exploited Vulnerabilities catalog

  3. Added to KEV Intelligence KEV Feed

    High-confidence, third-party attested exploitation

  4. CVE published

    Vulnerability disclosed publicly

  5. CVE ID reserved

    Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro pricing Read API docs
  • Evidence confidence and provenance
  • First-party sensor telemetry
  • PoC and scanner references
  • Affected versions and enrichment
  • Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2025-8088

Free JSON includes basic KEV fields 
{
  "cve_id": "CVE-2025-8088",
  "confidence": "Confirmed",
  "cvss_score": 8.4,
  "cvss_estimated": false,
  "epss_score": 0.94551,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "attempts": 0, "sensors": 0 }
}

Early warning alerts

Get alerts on high-impact exploitation

Receive curator-selected alerts when exploitation activity warrants attention. Each alert includes the evidence and context needed to decide what requires attention now.

Occasional high-impact alerts. Unsubscribe anytime. See our Privacy Policy.