CVE-2025-8088: WinRAR — Silent Credential Theft & Espionage (June 2026)

CVE-2025-8088 — WinRAR Vulnerability

CVE-2025-8088 is a high-severity vulnerability in WinRAR that allows attackers to exploit a path traversal flaw for remote code execution. This CVE is under active exploitation as of June 2026 by Russia-aligned threat actors targeting Ukrainian government, military, and judicial networks. The flaw enables silent deployment of malware for credential theft and espionage, even after a patch was released.

Attack Vector

Attackers deliver malicious RAR archives via spear-phishing emails. These archives abuse NTFS Alternate Data Streams and the path traversal vulnerability to drop payloads outside the extraction directory, including into Windows Startup folders. Common indicators include mshta.exe executing HTA files, LNK files placed in Startup, and PowerShell scripts reading from C:\ProgramData. Exfiltration uses RC4-encrypted HTTPS traffic, and attackers often use spoofed URLs with HTTP basic-auth formatting to evade detection.

Who Is at Risk

All organizations using unpatched versions of WinRAR are vulnerable, with confirmed active targeting of Ukrainian government, military, and judicial entities. Systems where users have privileges to extract RAR files or interact with email attachments are especially at risk. The threat is global, but current campaigns focus on Ukraine.

Patch & Mitigate

• Patch: Update to the latest WinRAR release (version addressing CVE-2025-8088) immediately. Do not delay patching on any endpoint.
• Workaround: Block RAR file attachments in email and restrict use of WinRAR where possible until patched.
• Detect: Monitor for extraction of RAR files containing NTFS ADS, mshta.exe or PowerShell activity from unusual locations, and outbound HTTPS connections with RC4 encryption. Look for LNK or HTA files appearing in Startup folders and suspicious HTTP basic-auth URL patterns in logs.

MITRE ATT&CK

• TA0001 — Initial Access: Spear-phishing with malicious RAR archives delivers initial payloads.
• TA0002 — Execution: Exploited path traversal leads to execution of dropped malware via mshta.exe and LNK files.
• TA0010 — Exfiltration: Stolen data is exfiltrated over RC4-encrypted HTTPS connections, evading standard detection.

Source: https://securityonline.info/winrar-vulnerability-ukraine-cve-2025-8088