# Unpatched and end-of-support software on Windows endpoints exposes KEV-listed vulnerabilities (Acronis TRU telemetry; CVE-2023-38831, CVE-2026-59265)

> Acronis Threat Research Unit telemetry from 1.8M+ business computers (2026-09-30) shows 22.1% of Windows PCs with update data have an app security update waiting more than 30 days and 22.8% run at least one end-of-support product. On 77% of PCs with a waiting update, the update fixes a CISA KEV-listed weakness, and 57.2% of those are tied to ransomware use.

- **Published:** 2026-11-11T09:50:01Z
- **Last reviewed:** 2026-11-11T09:50:01Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5749
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5749.png
- **ID:** TL-2026-5749
- **Severity:** MEDIUM
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 26 (3 shown free below)
- **CVEs:** CVE-2023-38831, CVE-2026-59265

## Description

Acronis TRU (author Alexander Ivanyuk, published 2026-11-11) analysed telemetry from more than 1.8 million business computers online on 2026-09-30. The average Windows PC carries 38 applications and 22.3% carry more than 50. 25.6% of Windows installs with a known install date are older than three years. Removed Windows apps had been installed 677 days on average, and 46.3% stayed more than a year. 22.8% of Windows PCs run at least one product its maker no longer supports, including Office 2016/2019 (9.8%, support ended 2025-10-14), Silverlight (5.4%), SQL Server 2008/2012/2014 engines (4%), Office 2007/2010/2013 (3%), Acrobat and Reader 9/X/XI (2.9%), Chrome 109 or older (1.9%), Flash Player (1.8%), Java 6 and 7 (1.2%), Shockwave Player (0.48%), QuickTime for Windows (0.25%) and Python 2 (0.03%).

Acronis defines a waiting update as an app security update that is new, failed or pending restart, fixes at least one known weakness, and has been available for more than 30 days (OS updates excluded). Update data exists for 41.5% of the Windows PCs studied; 22.1% of those have such an update waiting (9.2% of all Windows PCs). Of those PCs, 77% have an update that fixes a CISA-listed exploited weakness and 57.2% of those are tied to ransomware. Most-affected apps by share of PCs with update data: WinRAR 5.3% (99.6% with an exploited-weakness fix, oldest waiting update 2020), Java 4.9% (96.7%, oldest 2016), Firefox 4.5% (87.1%, oldest 2013), Notepad++ 4.0%, 7-Zip 3.8%, VLC 1.4%, Chrome 0.8%, Zoom 0.6%, Foxit Reader 0.4%, TeamViewer 0.3%, TightVNC 0.3% (all critical), Flash Player 0.2% and Thunderbird 0.2%. Cited CISA KEV entry counts are WinRAR 5, 7-Zip 1, Firefox 12, Java 13 and Acrobat/Reader 24. Median time to install a security update is 6 days across all apps but 35 days for WinRAR, 63 for UltraVNC, 71 for VLC and about 1,000 for Java.

Two CVEs are named. CVE-2023-38831 (RARLAB WinRAR before 6.23, CVSS 3.1 7.8, NVD CWE-345, CISA KEV added 2023-08-24) lets attackers run arbitrary code when a user opens a benign file inside a crafted ZIP archive, because a same-named folder is processed and can contain executable code. It was exploited in the wild from April 2023 by cybercriminals (Group-IB reported DarkMe, GuLoader and Remcos RAT delivered to traders via forums) and by state-backed actors (Google TAG: FROZENBARENTS/Sandworm, FROZENLAKE/APT28, ISLANDDREAMS/APT40). CVE-2026-59265 (Apache OpenOffice up to 4.1.16, published 2026-10-02, CVSS 3.1 8.8 secondary score, CWE-426) is a code-execution flaw in the Java integration triggered by opening a crafted untrusted document. CISA SSVC lists exploitation as none, and the fix is expected in 4.1.17, which is in release-candidate phase. The workaround is to disable Java runtime integration and avoid untrusted files.

The report also flags remote-control tools with waiting updates (TeamViewer 0.3%, TightVNC 0.3% all critical, UltraVNC 0.2% with 93% critical). It states that its findings describe exposure on computers, not confirmed breaches. The source gives no actor attribution, malware family or IOCs for this report itself; the IOCs below are historical indicators from primary research on CVE-2023-38831, included as pivot material for defenders. The overall severity is analyst-assigned (MEDIUM) because this is aggregate exposure telemetry, not a single exploit.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1203 Exploitation for Client Execution
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1547.001 Registry Run Keys / Startup Folder
- T1574.001 DLL
- T1036.007 Double File Extension
- T1218.011 Rundll32
- T1555.003 Credentials from Web Browsers
- T1219 Remote Access Tools

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**WinRAR CVE-2023-38831 Archive Exploit Spawning Script Interpreter (Exploitation)** (`TL-2026-5749-SPL-001`)

Detects WinRAR (CVE-2023-38831, fixed in 6.23) or Apache OpenOffice (CVE-2026-59265, through 4.1.16) spawning cmd, PowerShell, wscript, mshta, rundll32 or regsvr32. In the WinRAR exploit a user double-clicks a decoy file inside a crafted ZIP and a same-named folder runs a script from a Rar$DI temp directory, delivering DarkMe, GuLoader and Remcos RAT. Flags Rar$DI extraction paths. WinRAR is KEV-listed and still unpatched on 5.3% of Windows PCs per Acronis TRU.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1203, T1204.002, T1036.007
- **Data sources:** sysmon, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
(ParentImage="*\\WinRAR.exe" OR ParentImage="*\\soffice.bin" OR ParentImage="*\\soffice.exe")
(Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe")
| eval rar_extract_dir=if(like(CommandLine, "%Rar$DI%"), "yes", "no")
| fillnull value="n/a" User ParentCommandLine
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as child_images values(CommandLine) as child_commands values(ParentCommandLine) as parent_commands values(rar_extract_dir) as rar_extract_dir by host User ParentImage
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("WinRAR.exe", "soffice.bin", "soffice.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")
| extend RarExtractDir = ProcessCommandLine has "Rar$DI" or InitiatingProcessCommandLine has "Rar$DI"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, RarExtractDir, SHA256
| order by Timestamp desc
```

### Sigma

```yaml
title: WinRAR or OpenOffice Spawning Script Interpreter (CVE-2023-38831 and CVE-2026-59265)
id: 3f1c7a52-6d0e-4b8a-9c21-5e7a0b4d1f01
status: experimental
description: Detects WinRAR launching a command shell or script host, the post-exploitation behaviour of CVE-2023-38831 where a benign looking file in a crafted archive triggers a same-named folder holding a script. Also covers Apache OpenOffice soffice spawning interpreters, matching CVE-2026-59265 Java integration code execution.
references:
  - https://www.acronis.com/en/tru/posts/every-pc-has-a-junk-drawer-and-attackers-know-it/
  - https://nvd.nist.gov/vuln/detail/CVE-2023-38831
  - https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/
  - https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/
author: Threadlinqs Team
date: 2026/11/11
tags:
  - attack.execution
  - attack.t1203
  - attack.t1204.002
  - cve.2023.38831
  - cve.2026.59265
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\WinRAR.exe'
      - '\soffice.bin'
      - '\soffice.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Administrators extracting archives that ship a legitimate installer script
  - OpenOffice macros that intentionally call cmd.exe
level: high
```

**Known false positives:**

- Admins or packaging staff extracting archives that legitimately include setup scripts run from WinRAR
- OpenOffice macros or extensions that intentionally invoke cmd.exe or PowerShell

**Tuning notes:** Exclude known software-deployment hosts and service accounts. Raise severity when CommandLine contains Rar$DI. Scope to WinRAR builds below 6.23 using software inventory if available.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CVE-2023-38831 Double Extension Script in WinRAR Rar$DI Extraction Path (Exploitation) (locked: unlock with TL Creds)
- Rundll32 OCX Loading and ImagingDevices Sideload Host (Post-Exploitation) (locked: unlock with TL Creds)
- TightVNC UltraVNC TeamViewer Execution from User Path or Script Parent (C2 Remote Access) (locked: unlock with TL Creds)
- CVE-2023-38831 Campaign Known Malicious Sample Hash Execution (Exploitation) (locked: unlock with TL Creds)
- PowerShell Browser Credential Store Theft IRONJAW Style (Post-Exploitation) (locked: unlock with TL Creds)
- Webhook.site Fex.net Dropbox API Callback from Script Host or User Path Binary (C2) (locked: unlock with TL Creds)
- DarkMe Run Key and ImagingDevices.exe Autostart Persistence (Post-Exploitation) (locked: unlock with TL Creds)
- CVE-2023-38831 Campaign and Community Sibling C2 Infrastructure Contact (C2) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 26)

Defanged, TLP:CLEAR.

- IP address: `45.74.19[.]96`
- Domain: `corialopolova[.]com`
- URL: `hxxp://webhook[.]site/e2831741-d8c8-4971-9464-e52d34f9d611`

Full set of 26 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Every PC has a junk drawer, and attackers know it (Acronis TRU)](https://www.acronis.com/en/tru/posts/every-pc-has-a-junk-drawer-and-attackers-know-it/)
- [NVD: CVE-2023-38831](https://nvd.nist.gov/vuln/detail/CVE-2023-38831)
- [NVD: CVE-2026-59265](https://nvd.nist.gov/vuln/detail/CVE-2026-59265)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Group-IB: CVE-2023-38831 WinRAR zero-day exploited against traders](https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/)
- [Google TAG: Government-backed actors exploiting WinRAR vulnerability](https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/)
- [CERT-UA report on FROZENLAKE (APT28) WinRAR campaign](https://cert.gov.ua/)
- [Apache OpenOffice security: oss-security disclosure for CVE-2026-59265](https://www.openwall.com/lists/oss-security/2026/10/02/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5749