How are you handling WinRAR updates after the latest RCE?

Treat it as a third-party patch management problem. Inventory WinRAR installations, deploy the fixed version through your normal tool, and check which machines actually received it. A deployment report won't tell you much about devices that aren't enrolled.

For contractor and personal devices, check what your policies or contracts require and how compliance is verified. If you can't manage or verify those machines, that's a separate gap from pushing an update to company devices.

7-Zip can extract RAR archives, so receiving a vendor's RAR files doesn't necessarily mean you need WinRAR. It can't create RAR archives, though. Check whether anyone actually needs to produce them before switching.

Windows 11 also has native RAR support, which may be enough for straightforward extraction. Test the particular files and workflow rather than assuming every archive feature will carry over.

Automatic updates aren't the only answer. Some admins prefer to review and deploy updates themselves because an update channel can also be a supply chain risk. An update notification would still be useful without adding another background service.

WinGet is another option for machines where it's available. You can use it to install or upgrade WinRAR, or run upgrades on a schedule. Test the command in your environment and monitor the results rather than assuming a scheduled task reached every user and device.

NanaZip was also suggested as an alternative that updates through the Microsoft Store, though you'll still want to check whether it fits your archive workflow.

One clarification on the threat: the reported issue involves a user opening a crafted archive. Calling it remote code execution doesn't mean an attacker can necessarily exploit an untouched machine without that interaction. The interaction requirement doesn't make unpatched archive handling safe.