August 2026 CVE of the Month: The 7-Zip Bug Every Scorecard Says to Ignore (CVE-2026-58052)
In January 2023, this column's first life at Kenna featured CVE-2022-44698, a Windows SmartScreen Mark-of-the-Web bypass that attackers were happily using while the scoring systems shrugged. Three and a half years later, here we are again. This month's pick scores 3.3 under CVSS v3.1, the kind of number that never makes a patch queue, and our sensors have recorded it being exploited in the wild multiple times in the past month.
This month's CVE of the Month is CVE-2026-58052
From the advisory description
7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier stream matches the exact name 'Zone.Identifier' while a RAR5 STM record named ':Zone.Identifier:$DATA' is not matched and NTFS canonicalizes it to the same stream, overwriting the propagated Internet-zone marker with ZoneId=0. A second STM record named '::$DATA' overwrites the extracted file's default data stream, letting an attacker defeat SmartScreen/MotW warnings and spoof file content.
CVE-2026-58052 was published June 28, 2026, affecting 7-Zip (7-Zip for Windows).
At a glance
Why CVE-2026-58052 matters
The Empirical Global model places it in the 98th percentile of all scored CVEs.
Empirical's exploitation telemetry shows in-the-wild exploitation within the last 7 days (most recent activity July 25, 2026). This signal comes from 2 distinct sources in our sensor network.
7-Zip might be the most installed, least managed software in the enterprise. It sits on developer workstations, admin jump boxes, and a large share of corporate laptops, usually as the default archive handler and often outside patch-management scope. That combination is what makes a low-severity bug in it interesting.
The bug is a guard that checks the wrong name. When 7-Zip extracts an archive, it is supposed to suppress any archive-supplied Zone.Identifier stream so the extracted file keeps its Internet-zone marker, the Mark of the Web (MotW) that SmartScreen and Office Protected View key on. The guard matches the exact name Zone.Identifier.
A crafted RAR5 archive can instead carry a stream record named :Zone.Identifier:$DATA, which the guard does not match but NTFS canonicalizes to the same stream, silently overwriting the marker with ZoneId=0 (trusted). A second record named ::$DATA overwrites the extracted file's default data stream, so the file that lands on disk is not the file the archive appeared to contain. The result: a phished RAR5 attachment whose payload opens with no SmartScreen warning and no Protected View. CVSS rates the attack vector local with passive user interaction, meaning someone has to extract the archive, which is exactly what phishing is for. As with July's Solr pick, the protection mechanism is the bypass.
A public proof of concept exists; it shipped in a researcher's exploit collection covered by Infosecurity Magazine. (The score's exploit-code driver reads zero because it counts curated databases like Metasploit and Exploit-DB, which have no entry.) Our sensor network has recorded exploitation from two distinct sources, in both of the two most recent observation windows, most recently on July 25.
What's driving the score?
| Indicator | Weight | Detail |
|---|---|---|
| Exploitation | +2.21 | 1-7 days (1, wt=2) |
| References | +0.11 | CVE Refs (3, wt=0.02) |
| Vuln Attributes | -0.08 | Nothing Interesting |
| Threat Intel | +0.07 | Nothing Interesting |
| Chatter | +0.02 | Sightings (19, wt=-0.003) |
| Exploit Code | +0.01 | Metasploit (0, wt=0.02); GitHub (0, wt=-0.01); ExploitDB (0, wt=0.008) |
| Vendor | -0.00 | Nothing Significant |
Weights are the model's attribution for each indicator group; the counts shown are inputs, not count-times-weight arithmetic.
Bottom line
Read this CVE the way your tooling does. CVSS says 3.3 under v3.1 and 4.8 under v4.0: low severity either way, because a spoofing bug with no direct code execution scores as a nuisance. EPSS, which forecasts exploitation from public signals, puts it near the bottom of its distribution; with no Metasploit module and almost no chatter, that is EPSS working exactly as designed on the inputs it has. It is not in CISA KEV, which serves a federal remediation mandate with its own evidentiary bar. And 7-Zip, like many single-maintainer open-source projects, publishes fixes in release notes rather than security advisories, so advisory-driven feeds see nothing. Every feed a typical patch policy consumes reads quiet here.
Our Global model puts it in the 98th percentile on the strength of the one input those feeds do not carry: exploitation telemetry. MotW bypasses are an initial-access primitive. They do not own the box; they remove the last warning between a phishing email and a running payload, which is exactly why attackers keep returning to them.
Impact scores measure what a bug does to a machine. Attackers assemble chains. We will not tell you a 3.3 outranks a 9.8; we will tell you that attackers are using this 3.3 right now and are not using most 9.8s, and that our model scores what they do rather than what the label says. If your prioritization starts and ends with the scorecard, this CVE does not exist for you. That is why it is this month's pick.
Mitigation status
There is no patch to deploy yet, which makes this one operational.
Check affected software.
The affected range per the advisory is 7-Zip for Windows through 26.01. No fixed release is confirmed as of this writing; check 7-zip.org for anything newer than 26.01 before you scope, and treat installed copies as unpatched until then.
Windows only: Mark of the Web is an NTFS mechanism, so other platforms are unaffected.
Finding installs is the hard part. Credentialed scanner checks exist (Tenable plugins 324932 and 326565) but only reach assets already in scanner scope and will not see portable copies. Hunt for 7z*.exe outside Program Files with your EDR or software inventory, and remember that some third-party products bundle 7-Zip's code.
Reduce the blast radius.
Do not let SmartScreen or Protected View be the only control between mail and execution: application control (WDAC or AppLocker) does not key on zone markers. Note that Office's block-macros-from-the-internet policy also keys on MotW, so it fails to this same bug.
Microsoft's attack surface reduction rule that blocks executable content from email clients and webmail cuts the most common delivery path.
Consider blocking or detonating RAR5 attachments at the mail gateway, with eyes open: a gateway only sees the malicious stream records if it parses RAR5 headers, and encrypted or nested archives hide them.
Hunt.
Where you collect file-stream events (Sysmon Event ID 15 or your EDR's alternate-data-stream telemetry), look for 7-Zip processes writing Zone.Identifier streams with ZoneId=0. 7-Zip should be writing ZoneId=3 or nothing; a trusted-zone write is the anomaly.
Follow up on process creation of freshly extracted executables in user-writable paths.
References
https://nvd.nist.gov/vuln/detail/CVE-2026-58052
https://cxsecurity.com/issue/WLB-2026070002
https://www.infosecurity-magazine.com/news/researcher-exploitarium-exploits
https://www.tenable.com/plugins/nessus/324932
https://www.tenable.com/plugins/nessus/326565
https://kenna-gatsby.netlify.app/blog/january-vuln-of-the-month-cve-2022-44698/
Every month we pick one CVE, put the signals side by side (exploitation telemetry, EPSS, KEV, exploit code), and show our work. Empirical customers get the same signals across their entire vulnerability portfolio, every day. See how your portfolio ranks at empiricalsecurity.com.
