Warning: WinRAR Vulnerability CVE-2025-6218 Under Active Attack by Multiple Threat Groups
Summary: CISA added CVE-2025-6218, a path traversal flaw in Windows builds of WinRAR with a CVSS score of 7.8, to its Known Exploited Vulnerabilities catalog on Tuesday, citing evidence of active exploitation. RARLAB patched the bug in WinRAR 7.12 in June 2025, and reports from BI.ZONE, Foresiet, SecPod, and Synaptic Security attribute exploitation to three threat actors: GOFFEE, Bitter, and Gamaredon.
Why it matters: Gamaredon's use of the flaw against Ukrainian military, government, political, and administrative entities was first observed in November 2025 and marks the first instance of the group conducting destructive operations, with a wiper codenamed GamaWiper, rather than its traditional espionage. Federal Civilian Executive Branch agencies must apply fixes by December 30, 2025.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-6218CVE-2025-8088
- Related
- CVE-2025-6218: RARLAB WinRAR Path Traversal Vulnerability Known Exploited Vulnerabilities · Dec 09, 2025CVE-2025-8088: RARLAB WinRAR Path Traversal Vulnerability Known Exploited Vulnerabilities · Aug 12, 2025