{"id":121194,"date":"2025-08-13T20:30:26","date_gmt":"2025-08-13T20:30:26","guid":{"rendered":"https:\/\/cybersecuritynews.com\/?p=121194"},"modified":"2025-08-13T20:30:29","modified_gmt":"2025-08-13T20:30:29","slug":"cisa-added-winrar-zero-day-vulnerability","status":"publish","type":"post","link":"https:\/\/cybersecuritynews.com\/cisa-added-winrar-zero-day-vulnerability\/","title":{"rendered":"CISA Added WinRaR Zero-Day (CVE-2025-8088) Vulnerability That is Actively Exploited In the Wild"},"content":{"rendered":"\n

The U.S. Cybersecurity and Infrastructure Security Agency has added<\/a> this vulnerability to its Known Exploited Vulnerabilities catalog, with a due date of September 2, 2025, for federal agencies to apply mitigations.<\/p>\n\n\n\n

WinRAR has released version 7.13 to address a critical security vulnerability that has been actively exploited by cybercriminals, marking another significant security incident for the popular file compression software. <\/p>\n\n\n\n

The vulnerability, designated CVE-2025-8088<\/a>, allows attackers to execute arbitrary code through maliciously crafted archive files, prompting immediate action from users worldwide.<\/p>\n\n\n\n

Critical Security Flaw Exploited by Russian Hackers<\/strong><\/h2>\n\n\n\n

The newly discovered vulnerability represents a serious threat to Windows users<\/a>, with security researchers confirming that it has been exploited in active campaigns. <\/p>\n\n\n\n

CVE-2025-8088 is a path traversal vulnerability that affects the Windows versions of WinRAR, UnRAR, and associated components, allowing specially crafted archives to bypass user-specified extraction paths and write files to unintended locations on the file system. <\/p>\n\n\n\n

This capability enables attackers to execute arbitrary code on compromised systems, making it a particularly dangerous security flaw.<\/p>\n\n\n\n

ESET researchers have linked this vulnerability to exploitation by the Russian RomCom group,<\/a> which has been targeting companies across Europe and Canada.<\/p>\n\n\n\n

The cybersecurity firm’s research team, including Anton Cherepanov, Peter Ko\u0161in\u00e1r, and Peter Str\u00fd\u010dek, discovered the vulnerability and reported it to WinRAR developers. <\/p>\n\n\n\n

The vulnerability has been assigned a CVSS score of 8.4, classifying it as HIGH severity, which underscores the critical nature of this security issue.<\/p>\n\n\n\n

Technical Details and Affected Systems<\/strong><\/h2>\n\n\n\n

The directory traversal vulnerability is distinct from a previously patched security flaw that was addressed in WinRAR version 7.12, indicating that this represents a new attack vector that required separate remediation. The affected systems include:<\/p>\n\n\n\n