Exploitation timeline
Threadlinqs has recorded 5 RARLAB CVEs published between and . The busiest month was 2023-08 (1 new CVE). 3 of them (60%) are listed in CISA KEV, which means exploitation in the wild has been confirmed.
Most exploited vulnerabilities
Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 5 of 5 tracked RARLAB CVEs.
- CVE-2023-38831high 7.8KEVRansomwareEPSS 99.8%
- CVE-2025-8088high 8.8KEVRansomwareEPSS 94.3%
- CVE-2025-6218high 7.8KEVEPSS 90.5%
- CVE-2023-40477high 7.8EPSS 11.4%
- CVE-2026-14191high 7.8EPSS 0.4%
Products affected
Threadlinqs normalises CPE and CNA product records across all 5 CVEs; 4 distinct RARLAB products are affected. The most frequently affected:
- WinRAR 5 CVEs
- RAR 1 CVE
- UnRAR 1 CVE
- UnRAR.dll 1 CVE
Threat activity
14 tracked threat campaigns reference RARLAB products or exploit RARLAB CVEs:
- Kazakhstan-nexus UAT-6275 (TAG-193 / Silent Lynx) targets CIS government organizations with Chvost, Laplas and PickleShell (CVE-2025-8088, CVE-2025-25257)HIGH
- Russia (GRU Unit 26165 / APT28) Runs Multi-Vector Surveillance, Intimidation, Sabotage and Cyber Espionage Campaign Against Europe's Ukraine Defence Supply ChainHIGH
- Cyble H1 2026 Threat Actor Landscape: 261 Tracked Groups, Five Most Active Actors ProfiledHIGH
- UAC-0099 Abuses Notepad++ Plugin Loading (CVE-2025-56383) to Deploy LunchPoke, BurnyBear, MatchBoil V2 MalwareHIGH
- Gamaredon (Primitive Bear / Shuckworm) APT Profile: Russia-Aligned Espionage Against Ukraine and NATO, Now Exploiting CVE-2025-8088 (WinRAR)HIGH
- WinRAR 7.23 Fixes Heap Overflow in RAR5 Recovery Volume Processing (CVE-2026-14191)MEDIUM
- Gamaredon Expands Ukraine Attacks with PteroSetup Revival and Cloud Service Abuse, Exploiting WinRAR Flaw CVE-2025-8088HIGH
- Turla STOCKSTAY .NET Backdoor Targeting Ukraine Government and Military via CVE-2025-8088HIGH
- Russian APT Gamaredon Upgrades Arsenal with Six New PowerShell Downloaders, Cloudflare/Devtunnel C2 Concealment, and Turla Collaboration Delivering Kazuar Backdoor (2025)HIGH
- Russia-aligned Gamaredon (Earth Dahu) and UAC-0226 (SHADOW-EARTH-066) Exploit Patched WinRAR Path-Traversal CVE-2025-8088 (NTFS ADS) Against Ukrainian OrganizationsHIGH
- Gamaredon (Russia/FSB) "GammaWorm" — VBScript Worm Hidden in NTFS ADS with Cloud-Service Dead Drop Resolver C2 (Gamma Toolset) vs Ukraine, WinRAR CVE-2025-8088 Initial AccessHIGH
- UAC-0252 SHADOWSNIFF & SALATSTEALER — Credential Theft Campaign Impersonating Ukrainian Government via GitHub-Hosted Payloads and XSS DeliveryHIGH
- APT28/UAC-0001 Sustained Cyber Espionage Against Ukraine & EU (2024-2026 New TTPs)HIGH
- RomCom & Paper Werewolf Exploiting WinRAR CVE-2025-8088 Zero-Day via ADS Path TraversalCRITICAL
Threat actors targeting RARLAB
Named threat actors attributed to campaigns that involve RARLAB products or CVEs, with the number of linked campaigns:
How to prioritise RARLAB patching
This order follows the data Threadlinqs holds for RARLAB, not a generic severity checklist:
- 3 of 5 RARLAB CVEs (60%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with CVE-2023-38831, CVE-2025-8088, CVE-2025-6218.
- 2 CVEs are known to be used in ransomware campaigns; patch these ahead of other KEV entries on internet-facing systems.
- Outside KEV, the highest EPSS scores are CVE-2023-40477 (11.4%), CVE-2026-14191 (0.4%).
- 0 CVEs score Critical and 5 High on CVSS v3 (maximum 8.8, average 8); sequence these after KEV and high-EPSS items.
- 5 CVEs have a public exploit or proof of concept recorded, which shortens the time from disclosure to attack.
About this data
Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-15 and refresh daily.