Threat actors are exploiting a recently patched 7-Zip vulnerability that leads to remote code execution (RCE), NHS England warns. The bug, tracked as CVE-2025-11001 (CVSS score of 7.0), is described as a file parsing directory traversal issue, and requires user interaction for successful exploitation. The flaw impacts 7-Zip’s handling of symbolic links in ZIP files, as crafted data could be used to traverse to unintended directories during processing. “An attacker can leverage this vulnerability to execute code in the context of a service account,” a Trend Micro Zero Day Initiative (ZDI) advisory reads. According to ZDI, attack vectors depend on implementation. Ryota Shiga of GMO Flatt Security was credited for finding this security defect and an identical vulnerability tracked as…