Russia-Aligned Hackers Exploit Unpatched WinRAR Vulnerability Against Ukrainian Organizations
By
By: Hiroyuki Kakara, Feike Hacquebord Jun 08, 2026 Read time: ( words)
Hot, fresh, and worth queueing round the block for.
Summary
Two Russia-aligned cyberattack campaigns are actively exploiting CVE-2025-8088, a path traversal vulnerability in WinRAR patched in July 2025, to target Ukrainian organizations nearly a year after the fix was released. The article highlights how unmanaged software and slow patch deployment leave organizations vulnerable long after security updates are available, with threat actors continuing to use the flaw as an entry point for intrusions against Ukraine.
Key quotes
· 3 pulledCVE-2025-8088, a path traversal vulnerability in WinRAR patched in July 2025, is still being exploited by multiple intrusion sets targeting Ukraine
Two separate Russia-aligned campaigns are still exploiting the WinRAR flaw CVE-2025-8088 against Ukrainian organizations nearly a year after it was patched
Unmanaged software keeps an exploited entry point open long after the fix ships
You might also wanna read
Russian Cybercrime Groups Exploit WinRAR Zero-Day Vulnerability
A high-severity zero-day vulnerability in WinRAR is being actively exploited by two Russian cybercrime groups, allowing them to backdoor com
arstechnica.com·10mo ago
CVE-2026-45185 (Dead.Letter): Unauthenticated RCE in Exim Discovered by XBOW
XBOW discovered CVE-2026-45185, a critical unauthenticated remote code execution vulnerability in Exim mail server. The article details the
xbow.com·27d ago
Polish Energy Grid Targeted by Wiper Malware, Likely from Russian State Hackers
Polish electric grid was targeted by wiper malware, likely from Russian state hackers, in an attempt to disrupt electricity delivery operati
arstechnica.com·4mo ago
CVE-2025-53136: Microsoft Patches Windows Kernel Information Disclosure Vulnerability Bypassing KASLR
Microsoft patched CVE-2025-53136, a kernel information disclosure vulnerability in Windows NT OS Kernel that allowed leaking kernel base add
crowdfense.com·9mo ago
Critical React Vulnerability (CVE-2025-55182) Enables Remote Code Execution in React 19 and Next.js
A critical security vulnerability (CVE-2025-55182) has been discovered in React Server Components' 'Flight' protocol, affecting React 19 and
wiz.io·6mo ago
Critical Security Vulnerability CVE-2025-66478 in React Server Components Protocol
A critical security vulnerability (CVE-2025-66478) has been discovered in the React Server Components (RSC) protocol with a CVSS score of 10
nextjs.org·6mo ago