Recent Windows and WinRAR Vulnerabilities
The US Cybersecurity and Infrastructure Security Agency (CISA) has added two recently disclosed vulnerabilities to its catalog of known exploited vulnerabilities, indicating active abuse in real-world attacks.
WinRAR Remote Code Execution – CVE-2025-6218
The first issue, CVE-2025-6218, affects the popular WinRAR file compression utility. The flaw is a directory traversal vulnerability that can be leveraged to achieve remote code execution, allowing an attacker to run arbitrary code on a victim’s system.
Importantly, the vulnerability impacts only WinRAR version 7.11 (64-bit). It carries a CVSS score of 7.8, placing it firmly in the high-severity category.
The vulnerability was officially assigned a CVE on 21 June, following earlier disclosure by Trend Micro’s Zero Day Initiative. According to Trend Micro, exploitation requires user interaction, meaning the victim must open a malicious archive or visit a specially crafted webpage.
Evidence now suggests that attackers are actively exploiting this behaviour, highlighting the ongoing risk of malicious downloads and phishing-based delivery methods.
Recommended countermeasures and user actions:
Immediately update WinRAR to the latest available version, which includes a patch for this issue.
Avoid opening compressed files from untrusted or unknown sources, especially those received via email or messaging platforms.
Use endpoint protection or antivirus software capable of scanning archive contents before extraction.
In enterprise environments, consider restricting or monitoring archive file execution and disabling WinRAR where it is not required.
Windows Privilege Escalation – CVE-2025-62221
The second vulnerability, CVE-2025-62221, was disclosed as part of Microsoft’s most recent Patch Tuesday release and has already been observed in active exploitation, according to both Microsoft and CISA.
This flaw is a use-after-free vulnerability in the Windows Cloud Files Mini Filter Driver, which could allow a local attacker to escalate privileges to SYSTEM level. Mini filter drivers are commonly used for functions such as encryption, backups, and file synchronization. In this case, the vulnerable component supports cloud storage integrations, including OneDrive and Google Cloud.
Rapid7 lead software engineer Adam Barnett noted that Microsoft has rated the issue as “important” rather than “critical,” as successful exploitation requires an attacker to already have a foothold on the target system.
However, Barnett cautioned that active exploitation combined with SYSTEM-level access makes this vulnerability a serious concern for defenders and a high priority for remediation.
Recommended countermeasures and user actions:
Apply the latest Windows security updates immediately, particularly on systems exposed to untrusted users or workloads.Monitor for signs of post-exploitation activity, such as unexpected privilege escalation or suspicious service creation. Enforce the principle of least privilege, ensuring users do not have unnecessary local access. Use endpoint detection and response (EDR) tools to identify abnormal kernel or driver behaviour. In enterprise environments, prioritize this fix in patch management workflows, especially for systems handling sensitive data.
Both vulnerabilities underscore a familiar but critical reality: attackers are moving quickly to weaponize newly disclosed flaws. Users and organizations alike should prioritize timely patching, cautious file handling, and layered security controls to reduce exposure. With active exploitation confirmed, staying on top of updates and defensive measures is no longer optional—it’s essential.