Do Son CISA added two actively exploited zero-days to the KEV: a WinRAR directory traversal (CVE-2025-6218) planting malware in Startup folder, and a Windows Cloud Files UAF for SYSTEM privileges.
CVE-2025-6218
A flaw (CVE-2025-6218, CVSS 7.8) in WinRAR allows remote code execution via directory traversal when opening crafted archives. Update to 7.12 Beta 1 immediately!