Is CVE-2025-0411 (7-Zip Mark of the Web Bypass) being exploited in the wild?

Yes. CISA added CVE-2025-0411 to its Known Exploited Vulnerabilities catalogue on 6 February 2025, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. 7-Zip contains a protection mechanism failure vulnerability that allows remote attackers to bypass the Mark-of-the-Web security feature to execute arbitrary code in the context of the current user.

How to confirm active exploitation of CVE-2025-0411

For an “is it being exploited?” question, the practical answer comes from CISA KEV listing plus local exposure checks. KEV inclusion means there is reliable evidence of active exploitation, so treat this as a live issue rather than a theoretical bug. Confirm whether 7-Zip is present anywhere that can open untrusted archives, including user workstations, jump hosts, and automation endpoints.

Because the weakness is a Mark-of-the-Web bypass, the main exposure path is opening a crafted archive that should have been treated as coming from the internet. If that trust boundary is broken, the user may execute code with their own privileges when the archive contents are opened or launched. That makes inventory and usage context more important than simply knowing that 7-Zip is installed.

For authoritative version and remediation details, use the vendor advisory alongside the CISA Known Exploited Vulnerabilities Catalog and the NIST National Vulnerability Database. If you need prioritisation context, the FIRST EPSS signal can help rank remediation work, but KEV status should drive urgent handling first.

Why a Mark-of-the-Web bypass is operationally serious

Mark-of-the-Web is meant to preserve the “this came from outside” warning as files move through the desktop and browser boundary. When an archive tool strips or ignores that marker, the file can lose an important safety signal before the user even sees it. That turns a simple extraction workflow into a code-execution path if the user opens a malicious payload.

This is not just a browser or email problem. Any workflow that receives archives from clients, suppliers, ticket attachments, downloads, shared drives, or build artifacts can become a delivery path. Once the archive is unpacked, the user context matters: the attacker does not need system-level privileges if the goal is to run code, steal data, or stage follow-on access under the victim’s account.

In response terms, the closest comparison is a fast-moving exploitation event, not a slow burn configuration weakness. The right mental model is “can this archive be used to bypass a safety control and execute code?” rather than “is the product vulnerable in the abstract?” That framing keeps the response focused on exposure, user impact, and post-exploitation monitoring.

What to do if you cannot patch immediately

If patching is delayed, reduce the ways users can receive and open untrusted archives. Limit 7-Zip use on high-risk systems, block or detonate suspicious archives at the email and download layers, and tighten software controls around archive-opening tools. Where feasible, route internet-originated files through isolated analysis rather than letting them reach a normal workstation first.

Review whether archive handling is embedded in scripts, helpdesk processes, or automated transfer jobs, because those paths can bypass normal user caution. If a system must remain exposed for a short period, treat it as a temporary exception with compensating detection and shorter review intervals. The goal is to narrow the window in which a malicious archive can reach an active user session.

The NHIMG Zero-Day and Exploited Vulnerabilities Guide and Vulnerability Management Guide are useful here because they frame the triage problem correctly: exposure, exploitation evidence, and emergency containment matter more than routine patch queues.

Risk and Threat Considerations

Once a bug is in KEV, the risk shifts from “possible impact” to “adversaries are already using it,” which changes prioritisation immediately. For this class of flaw, the biggest concern is not only the vulnerable product itself, but the user trust boundary it weakens and the follow-on execution path it opens.

Failure mechanism: A crafted archive causes 7-Zip to bypass Mark-of-the-Web protections, so content that should carry internet-origin warnings is handled as if it were safer than it really is.

Impact: Attackers can deliver code that runs in the context of the current user, which can lead to data theft, persistence staging, credential harvesting, and lateral movement if the user has access to valuable systems.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST CSF 2.0, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	CVE exploitation requires prioritised remediation and exposure tracking.
Recommendation — Prioritise and remediate KEV-listed software on exposed endpoints first.
NIST CSF 2.0	DE.CM-09 — Vulnerabilities are identified and managed through detection processes	Active exploitation requires detection and management of vulnerable assets.
	RS.MA-01 — Incidents are contained and mitigated	A KEV-listed exploitation event needs containment while patching is pending.
Recommendation — Monitor affected assets and accelerate remediation when exploitation is confirmed. Contain exposed systems and apply compensating controls until patched.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The flaw requires prompt remediation and exception handling when patching lags.
Recommendation — Apply the fix quickly and track any temporary remediation exceptions.
OWASP ASVS	V13 — Configuration	The issue is a security-control failure in handling internet-origin content.
Recommendation — Harden file-handling and trust-boundary settings around archive processing.

Practitioner Guidance

What to verify: Confirm where 7-Zip is installed, whether it is used on internet-facing or high-trust endpoints, and whether users routinely open third-party archives from email, file sharing, or ticket attachments. Exposure is highest where archive handling is both common and poorly supervised.

What to prioritise: Patch or remove the tool first on systems that process untrusted files or have access to sensitive data. If you can only do one thing quickly, reduce the chance that a crafted archive reaches a live user session.

What to measure: Track how many endpoints still have the vulnerable tool, how many still receive externally sourced archives, and whether suspicious archive activity is being logged and investigated. If those numbers are opaque, you do not yet have enough visibility to trust the environment.

Practitioner takeaway: For KEV-listed flaws, the key decision is whether the affected software still sits on a path that handles untrusted content; if it does, treat exposure control and compromise hunting as urgent, not optional.