Threat operations/Vulnerabilities / CVE activity
AL
Member accessPublic view · sign in
How threat priority works

CVSS gives technical context. It never enters the VTP threat score. Public exploitation evidence and observations from your honeypots are separate facts.

Vulnerability threat dossier

CVE-2025-8088

dtsearchdtsearch

A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET.

VTP deterministic threat48.9of 100 · CVSS excluded

VTP analyst assessment

WinRAR path traversal used in CIS government targeting

AI-assisted analytical recommendationDoes not set factual exploitation state
AI review stateREVIEWED
AI priorityNONE
AI confidence88%
Public exploitation · VTP factKEV

Assessment

CVE-2025-8088 lets a malicious archive on Windows place files through path traversal and execute attacker code. CISA lists it as exploited and notes ransomware use. Talos reported UAT-6275 targeting CIS government organizations and using this flaw in infection chains.

Why it matters

  • A recipient must open a crafted archive, making email and file-delivery controls relevant.
  • Successful exploitation can execute attacker code on the Windows system.
  • If you use WinRAR on Windows, apply the vendor remediation and restrict untrusted archive handling.

Evidence

2 record references and 2 source references passed trusted post-response validation. The current deterministic record contains 0 independent evidence groups.

Uncertainties

Talos reporting supports regional government targeting, not customer compromise or broader targeting.

First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.

Next watchpoint

If you use WinRAR on Windows, identify installations and remediate affected versions.

AI baseline history (5)
  1. BASELINE ASSESSED
    WinRAR path traversal used in CIS government targetinggpt-5.6-terra · low
  2. BASELINE ASSESSED
    WinRAR path traversalgpt-5.6-terra · low
  3. BASELINE ASSESSED
    WinRAR path traversalgpt-5.6-terra · low
  4. BASELINE ASSESSED
    WinRAR path traversal code executiongpt-5.6-terra · low
  5. BASELINE ASSESSED
    WinRAR archive path traversal and code executiongpt-5.6-sol · high
Technical severityHIGHCVSS 8.4 · technical context
Public exploitationKEVGlobal public evidence
Exploit maturityNONE KNOWNReliability not implied
EPSS0.95100th percentile · prediction
Evidence confidence0%Strongest independent active claim
VelocitySTABLEMaterial events only
First-party telemetryFirst-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.
Availability: SENSOR_ONLINE_NO_MATCHING_ACTIVITY · Evidence: UNKNOWN
01

VTP deterministic assessment

Why this matters

  1. 01

    CISA KEV lists this vulnerability as known to be exploited globally.

  2. 02

    EPSS is 0.95; this is predictive context, not exploitation evidence.

  3. 03

    First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.

02

Material change ledger

What changed

RESEARCH PUBLICATIONNew technical research
CERT ADVISORYNew CERT advisory
KEV ADDEDCISA KEV entry added
03

Claim provenance

Evidence and source independence

4publications detected
4underlying evidence chains

2 primary sources · 0 dependent secondary reports · 2 reports with unresolved independence. Repetition remains visible without multiplying confirmation.

04

Event history

Threat timeline

  1. 14:0014 Oct
    RESEARCH PUBLICATION

    New technical research

    Cisco Talos published evidence linked to CVE-2025-8088.

  2. 00:0010 Aug
    CERT ADVISORY

    New CERT advisory

    CERT-FR published evidence linked to CVE-2025-8088.

  3. 00:0012 Aug
    KEV ADDED

    CISA KEV entry added

    CISA lists global known exploitation. This is not a VTP sensor observation.

05

Original publications

Source record

The Hacker NewsPRESSUNKNOWN

Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks

The threat actor known as Silent Lynx has been attributed to a fresh set of attacks targeting government organizations across the Commonwealth of Independent States (CIS). The activity, observed from June 2025 through August 2026, involves four different infection chains that make use of macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and crafted WinRAR archives

CVE-2025-25257CVE-2025-8088
Separate evidence group
Original
The Record from Recorded Future NewsPRESSUNKNOWN

Suspected Kazakhstan-linked hackers target governments across former Soviet states

A roughly 2-year-old cyber-espionage campaign against Central Asian states appears to originate in Kazakhstan, researchers said.

CVE-2025-8088
Separate evidence group
Original
Cisco TalosSECURITY RESEARCHINDEPENDENT

Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations

Talos and Recorded Future identified UAT-6275 activity targeting government organizations across the Commonwealth of Independent States. Recovered artifacts show additional interest in water resources and energy.

CVE-2025-25257CVE-2025-8088
Separate evidence group
Original
CERT-FRCERTINDEPENDENT

Multiples vulnérabilités dans ClamAV (10 août 2026)

De multiples vulnérabilités ont été découvertes dans ClamAV. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, un déni de service et un problème de sécurité non spécifié par l'éditeur.

CVE-2025-8088CVE-2026-20337CVE-2026-20338CVE-2026-20339CVE-2026-20345CVE-2026-20346CVE-2026-20347CVE-2026-20348
Separate evidence group
Original
06

Technical vulnerability data

Context, not threat proof

VTP threat score48.9vtp-threat-v1-public
Public exploitation30 / 30
EPSS prediction18.9 / 20
Exploit availability0 / 15
Source independence0 / 15
Intelligence recency0 / 10
Threat acceleration0 / 10
CVSS technical severityExcluded
CVSS
8.4 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE
CWE-35
CPE records
3
Deterministic history records
20
Primary technical reference
07

Raw observations

First-party sensor records

First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.