# RARLAB vulnerabilities & exploitation **CISA KEV** · **Ransomware** > As of 2026-10-15, Threadlinqs tracks 5 RARLAB CVEs, 3 in the CISA Known Exploited Vulnerabilities catalog, 2 used in ransomware campaigns, linked to 14 tracked threat campaigns and 11 named threat actors. **Data as of:** 2026-10-15 ## Exploitation timeline Threadlinqs has recorded 5 RARLAB CVEs published between 2023-08-15 and 2026-07-15. The busiest month was 2023-08 (1 new CVE). 3 of them (60%) are listed in CISA KEV, which means exploitation in the wild has been confirmed. ## Most exploited vulnerabilities Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 5 of 5 tracked RARLAB CVEs. - [CVE-2023-38831](https://intel.threadlinqs.com/cve/CVE-2023-38831) — HIGH 7.8 · KEV · Ransomware · EPSS 99.8% · 2023-08-23 - [CVE-2025-8088](https://intel.threadlinqs.com/cve/CVE-2025-8088) — HIGH 8.8 · KEV · Ransomware · EPSS 94.3% · 2025-08-08 - [CVE-2025-6218](https://intel.threadlinqs.com/cve/CVE-2025-6218) — HIGH 7.8 · KEV · EPSS 90.5% · 2025-06-21 - [CVE-2023-40477](https://intel.threadlinqs.com/cve/CVE-2023-40477) — HIGH 7.8 · EPSS 11.4% · 2024-05-03 - [CVE-2026-14191](https://intel.threadlinqs.com/cve/CVE-2026-14191) — HIGH 7.8 · EPSS 0.4% · 2026-07-01 ## Products affected Threadlinqs normalises CPE and CNA product records across all 5 CVEs; 4 distinct RARLAB products are affected. The most frequently affected: - WinRAR — 5 CVEs - RAR — 1 CVE - UnRAR — 1 CVE - UnRAR.dll — 1 CVE ## Threat activity 14 tracked threat campaigns reference RARLAB products or exploit RARLAB CVEs: - [Kazakhstan-nexus UAT-6275 (TAG-193 / Silent Lynx) targets CIS government organizations with Chvost, Laplas and PickleShell (CVE-2025-8088, CVE-2025-25257)](https://intel.threadlinqs.com/threat/TL-2026-3512) — HIGH — 2026-10-14 - [Russia (GRU Unit 26165 / APT28) Runs Multi-Vector Surveillance, Intimidation, Sabotage and Cyber Espionage Campaign Against Europe's Ukraine Defence Supply Chain](https://intel.threadlinqs.com/threat/TL-2026-2031) — HIGH — 2026-08-16 - [Cyble H1 2026 Threat Actor Landscape: 261 Tracked Groups, Five Most Active Actors Profiled](https://intel.threadlinqs.com/threat/TL-2026-1721) — HIGH — 2026-07-27 - [UAC-0099 Abuses Notepad++ Plugin Loading (CVE-2025-56383) to Deploy LunchPoke, BurnyBear, MatchBoil V2 Malware](https://intel.threadlinqs.com/threat/TL-2026-1657) — HIGH — 2026-07-23 - [Gamaredon (Primitive Bear / Shuckworm) APT Profile: Russia-Aligned Espionage Against Ukraine and NATO, Now Exploiting CVE-2025-8088 (WinRAR)](https://intel.threadlinqs.com/threat/TL-2026-1210) — HIGH — 2026-07-11 - [WinRAR 7.23 Fixes Heap Overflow in RAR5 Recovery Volume Processing (CVE-2026-14191)](https://intel.threadlinqs.com/threat/TL-2026-1063) — MEDIUM — 2026-07-02 - [Gamaredon Expands Ukraine Attacks with PteroSetup Revival and Cloud Service Abuse, Exploiting WinRAR Flaw CVE-2025-8088](https://intel.threadlinqs.com/threat/TL-2026-1216) — HIGH — 2026-06-29 - [Turla STOCKSTAY .NET Backdoor Targeting Ukraine Government and Military via CVE-2025-8088](https://intel.threadlinqs.com/threat/TL-2026-0966) — HIGH — 2026-06-28 - [Russian APT Gamaredon Upgrades Arsenal with Six New PowerShell Downloaders, Cloudflare/Devtunnel C2 Concealment, and Turla Collaboration Delivering Kazuar Backdoor (2025)](https://intel.threadlinqs.com/threat/TL-2026-0968) — HIGH — 2026-06-28 - [Russia-aligned Gamaredon (Earth Dahu) and UAC-0226 (SHADOW-EARTH-066) Exploit Patched WinRAR Path-Traversal CVE-2025-8088 (NTFS ADS) Against Ukrainian Organizations](https://intel.threadlinqs.com/threat/TL-2026-0723) — HIGH — 2026-06-09 - [Gamaredon (Russia/FSB) "GammaWorm" — VBScript Worm Hidden in NTFS ADS with Cloud-Service Dead Drop Resolver C2 (Gamma Toolset) vs Ukraine, WinRAR CVE-2025-8088 Initial Access](https://intel.threadlinqs.com/threat/TL-2026-0653) — HIGH — 2026-06-02 - [UAC-0252 SHADOWSNIFF & SALATSTEALER — Credential Theft Campaign Impersonating Ukrainian Government via GitHub-Hosted Payloads and XSS Delivery](https://intel.threadlinqs.com/threat/TL-2026-0171) — HIGH — 2026-03-02 - [APT28/UAC-0001 Sustained Cyber Espionage Against Ukraine & EU (2024-2026 New TTPs)](https://intel.threadlinqs.com/threat/TL-2026-0066) — HIGH — 2026-02-12 - [RomCom & Paper Werewolf Exploiting WinRAR CVE-2025-8088 Zero-Day via ADS Path Traversal](https://intel.threadlinqs.com/threat/TL-2026-0090) — CRITICAL — 2026-02-04 ## Threat actors targeting RARLAB Named threat actors attributed to campaigns that involve RARLAB products or CVEs, with the number of linked campaigns: - [Gamaredon](https://intel.threadlinqs.com/actor/Gamaredon) — 5 campaigns - [RomCom](https://intel.threadlinqs.com/actor/RomCom) — 2 campaigns - [APT28](https://intel.threadlinqs.com/actor/APT28) — 1 campaign - [APT38](https://intel.threadlinqs.com/actor/APT38) — 1 campaign - [Gamaredon Group](https://intel.threadlinqs.com/actor/Gamaredon%20Group) — 1 campaign - [SideCopy](https://intel.threadlinqs.com/actor/SideCopy) — 1 campaign - [Snake](https://intel.threadlinqs.com/actor/Snake) — 1 campaign - [Turla](https://intel.threadlinqs.com/actor/Turla) — 1 campaign - [UAC-0099](https://intel.threadlinqs.com/actor/UAC-0099) — 1 campaign - [UNC6508](https://intel.threadlinqs.com/actor/UNC6508) — 1 campaign - [Volt Typhoon - G1017](https://intel.threadlinqs.com/actor/Volt%20Typhoon%20-%20G1017) — 1 campaign ## How to prioritise RARLAB patching This order follows the data Threadlinqs holds for RARLAB, not a generic severity checklist: - 3 of 5 RARLAB CVEs (60%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with [CVE-2023-38831](https://intel.threadlinqs.com/cve/CVE-2023-38831), [CVE-2025-8088](https://intel.threadlinqs.com/cve/CVE-2025-8088), [CVE-2025-6218](https://intel.threadlinqs.com/cve/CVE-2025-6218). - 2 CVEs are known to be used in ransomware campaigns; patch these ahead of other KEV entries on internet-facing systems. - Outside KEV, the highest EPSS scores are [CVE-2023-40477](https://intel.threadlinqs.com/cve/CVE-2023-40477) (11.4%), [CVE-2026-14191](https://intel.threadlinqs.com/cve/CVE-2026-14191) (0.4%). - 0 CVEs score Critical and 5 High on CVSS v3 (maximum 8.8, average 8); sequence these after KEV and high-EPSS items. - 5 CVEs have a public exploit or proof of concept recorded, which shortens the time from disclosure to attack. ## About this data Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-15 and refresh daily. Canonical: https://intel.threadlinqs.com/vendors/rarlab All vendors: https://intel.threadlinqs.com/vendors Full detection coverage and IOCs via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp