7-Zip RCE Flaw Fixed: Update to Version 26.02 Now

7-Zip has patched a remote code execution (RCE) vulnerability in its just-released version 26.02. The flaw allows an attacker to execute arbitrary code on a victim's machine by getting them to open a specially crafted archive — a ZIP, 7z, RAR, or similar — with any unpatched version of the software.

Why This Matters

7-Zip is one of the most widely deployed file utilities on Windows, with hundreds of millions of installations across both personal and enterprise environments. It is also deeply trusted: users routinely open archives received from colleagues, download links, and support tickets without a second thought. That trust is exactly what makes an archive-triggered RCE so dangerous.

The attack surface is broad and the social engineering bar is low. A malicious actor only needs to deliver a booby-trapped archive via email attachment, a file-sharing link, or a compromised download page. No macro-enablement prompt, no UAC dialog, no unusual file extension — just "open the zip." On enterprise networks where 7-Zip is deployed via package managers or Group Policy, unpatched endpoints can number in the thousands.

Archive-based RCE vulnerabilities have historically been weaponized fast. WinRAR's CVE-2023-38831 went from public disclosure to active nation-state and cybercrime exploitation within weeks. The pattern is consistent: widely-used file tools, low user friction, high exploitation yield. Assume threat actors are already building lures.

What to Do

1. Update 7-Zip to version 26.02 immediately. Download directly from 7-zip.org — avoid third-party mirrors. The installer is a straightforward next-next-finish; no reboot required.

2. Audit your fleet. If you manage endpoints via RMM, Intune, SCCM, or similar, query for installed 7-Zip versions right now and push the update. Treat this as P1 patch velocity — do not wait for the next maintenance window.

3. Check for bundled copies. Many applications ship their own embedded copy of 7-Zip (or 7z.dll) for internal archive handling. Those copies will not be updated by the standalone installer. Audit vendor software and apply vendor patches as they release.

4. Harden detection in the meantime. Until patching is complete, consider adding EDR or SIEM rules flagging 7-Zip processes that spawn unexpected child processes — a common post-exploitation indicator when archive parsing is abused.

5. Notify non-technical users. If your org has staff who use 7-Zip without IT management, send a quick advisory: do not open archive files from unexpected senders until the update is confirmed deployed.

The fix is available now and takes under two minutes to apply. There is no reason to remain exposed.