The UpdateStar Vulnerability Index — August 2026

A Windows kernel zero-day exploited by North Korea's Lazarus group, a 7-Zip flaw with no fix at all, and WinRAR's year-old hole still being actively abused — the five most widely-installed consumer apps carrying open or freshly-patched CVEs this month are Microsoft Windows, WinRAR, Google Chrome, 7-Zip, and Mozilla Firefox.

Quick note before we start: every app mentioned in this report has a page on UpdateStar where you can check the current version, read the changelog, and download the latest release — links are inline throughout. If you'd rather have one tool watch all of this automatically, scroll to the bottom for our recommendation.

Here you can find the current UpdateStar Vulnerability Index.

As a reminder, you can make this site as preferred source by clicking here.

TL;DR

August 2026 stays firmly in SEVERE territory. Microsoft shipped its second-largest Patch Tuesday of the year — roughly 400–421 CVEs depending on how you count — and one of them was a Windows kernel-driver zero-day that Lazarus had already been exploiting for over a month before the fix shipped. Meanwhile WinRAR's 2025 path-traversal bug is now into its 13th month of continuous nation-state abuse, and a brand-new 7-Zip flaw ships this month with no patch available at all.

The structural story is the same one we keep telling: patching is losing the race. Mandiant's M-Trends 2026 puts the mean time-to-exploit at negative seven days — attackers routinely strike before a fix even exists. Verizon's 2026 DBIR finds organizations take a median of 43 days to remediate known-exploited vulnerabilities, with only 26% of CISA KEV flaws fully fixed. That gap is still the whole ballgame.

The Top 5 — August 2026

🔴 #1 — Microsoft Windows (AFD.sys / WinSock) · This Month's Spotlight: A Kernel Zero-Day, Exploited Before the Patch Existed

CVE: CVE-2026-68820 CVSS: 7.0 (High) Status: Patched August 11, 2026 · Confirmed exploitation in the wild · On CISA KEV

This is a use-after-free in the Ancillary Function Driver for WinSock — the kernel driver that sits underneath the Windows sockets API on every single Windows machine, reachable from any low-privilege account. Researchers tie exploitation to Lazarus, the North Korea-linked group, which has been using it since early July in "Operation Dream Job" attacks targeting defense and aerospace workers with fake job offers. Microsoft shipped the fix on August 11 (KB5121003 for Windows 11, KB5120249 for Windows 10 Extended Security Updates), and CISA added it to the Known Exploited Vulnerabilities catalog the same day.

The uncomfortable detail here is the timeline: by the time a patch existed, attackers had already had roughly six weeks with this hole open. It's a reminder that "patched" and "safe the whole time" are two different things.

What to do: Run Windows Update and confirm you're on the August cumulative update (builds 26200.9168 / 26100.9168 for Windows 11, or the equivalent August KB for Windows 10 ESU). This one doesn't have a separate download page — it comes through Windows Update.

🔴 #2 — WinRAR

→ Check your WinRAR version and update on UpdateStar

CVE: CVE-2025-8088 CVSS: 8.4 (High) Status: Patched in WinRAR 7.13 — July 2025 · Still under active nation-state exploitation · On CISA KEV

We wrote about this one back in June, and it's still here because the exploitation hasn't slowed down. Google's Threat Intelligence Group describes activity as "widespread and ongoing" — RomCom, Turla, a Gamaredon/APT44-linked cluster, a PRC-based actor, and UNC4895 have all been observed abusing the flaw to drop files directly into the Windows Startup folder via crafted RAR archives using NTFS Alternate Data Streams. Once the archive is opened, nothing else needs to happen; the payload runs at next boot.

The patch has existed for over a year. WinRAR has no auto-update mechanism, so a meaningful share of its roughly 500 million users are still exposed simply because nobody told them to go get the new version.

What to do: Download WinRAR 7.13 or later from UpdateStar. If you haven't manually updated WinRAR in the last year, assume you're vulnerable.

🟠 #3 — Google Chrome

→ Check your Chrome version and update on UpdateStar

CVE: CVE-2026-76034 / CVE-2026-76036 CVSS: Critical (pending final NVD score) Status: Patched August 20, 2026 · No confirmed in-the-wild exploitation

Two critical bugs fixed in the same release: an out-of-bounds write in WebGL, and a flaw in Dawn, Chrome's WebGPU implementation. Both are rated Critical by Google and could theoretically be chained toward code execution outside the sandbox via a crafted web page. The good news is there's no confirmed exploitation at time of writing. The less-good news is the same reminder as always — Chrome's fix only takes effect after a restart, and with an estimated user base in the billions, the update lag on browsers people never close is where the real risk sits.

What to do: Open chrome://settings/help, confirm you're on 151.0.7922.169 or later, and restart the browser. This also applies to Chromium-based browsers — Edge, Brave, Opera, Vivaldi — since they typically inherit the same engine fixes on a short delay.

🟡 #4 — 7-Zip · Notable This Month: A Flaw With No Fix Yet

→ Check your 7-Zip version and update on UpdateStar

CVE: CVE-2026-58052 CVSS: 4.8 (v4.0) / 3.3 (v3.1) — Medium Status: No fix available as of version 26.02 · Exploitation telemetry observed · Not yet on CISA KEV

This is the one worth paying closer attention to precisely because the CVSS score undersells it. The bug lets a crafted RAR5 archive erase the Mark-of-the-Web tag that Windows uses to flag internet-downloaded files — the same protection that triggers SmartScreen warnings. It works through a name collision in an NTFS Alternate Data Stream: 7-Zip's guard checks for the exact stream name Zone.Identifier, but a RAR5 record named :Zone.Identifier:$DATA slips past the check and NTFS quietly overwrites the real protection with a clean zone ID.

Security firm Empirical Security flagged it as their "CVE of the Month" for the exploitation signal they're seeing in telemetry, with activity observed as recently as July 25 — despite the low official severity score. As of this writing, there is no patched version available, even in the current 26.02 release. Combined with 7-Zip's total lack of an auto-update mechanism, this is a flaw you can't currently fix by updating.

What to do: Until a patch ships, avoid extracting RAR5 archives from untrusted sources with 7-Zip, or use an alternative tool that correctly preserves Zone.Identifier data. We'll update this section once RARLAB ships a fix.

🟠 #5 — Mozilla Firefox

→ Check your Firefox version and update on UpdateStar

CVE: MFSA 2026-74 — Firefox 154 Status: Patched August 18, 2026 · No confirmed in-the-wild exploitation

Firefox's August release fixes 58 CVEs, the largest single-release count we've tracked from Mozilla this year. Highlights include a sandbox escape in the Remote Settings Client (CVE-2026-75874) and a pair of WebAssembly/garbage-collector use-after-free bugs. Several of the "internally found" entries in Mozilla's own advisory carry their standard language that the bugs "showed evidence of memory corruption" and were "presumed exploitable with enough effort" — worth taking seriously even without a public exploit. No confirmed in-the-wild attacks so far, and Firefox's auto-update is generally reliable.

What to do: Help → About Firefox. You should already be on 154.0 or later if auto-update ran. If not, grab it from the link above.

Honorable Mentions

Microsoft (Patch Tuesday, August 11): The second-largest Microsoft release of 2026, behind only July's record-breaking 569. Counts vary by tracker — figures between roughly 394 and 421 CVEs have all been reported — but everyone agrees on three zero-days disclosed, one of them (CVE-2026-68820, covered above) confirmed exploited by Lazarus. The highest CVSS score of the batch belongs to a SharePoint remote-code-execution bug, CVE-2026-50522, at 9.8.

The Patch-Lag Picture

The number that should stick with you: mean time-to-exploit is now -7 days, per Mandiant's M-Trends 2026. On average, attackers are moving before a patch exists, not after. Verizon's 2026 DBIR (13,000+ organizations) finds median KEV remediation time sitting at 43 days, with only 26% of known-exploited vulnerabilities fully fixed.

The gap between "auto-updating software" and "software you have to remember to update yourself" keeps being the deciding factor. Windows, Chrome, and Firefox all patch themselves with only a restart required. WinRAR and 7-Zip do not — and this month, 7-Zip doesn't even have a patch to auto-update to.

The Honest Recommendation: Use the UpdateStar Client

The single most practical thing most Windows users can do — beyond enabling auto-update wherever it exists — is install a tool that watches the software that won't watch itself.

→ Download the UpdateStar Client for Windows

The UpdateStar client monitors your installed software against UpdateStar's database and notifies you when updates are available, covering exactly the category-two problem above: the WinRARs and 7-Zips of the world that never tell you they need attention. The Premium Edition adds CVE-level risk context for your installed apps.

Caveats and Methodology

• Microsoft's August CVE count is disputed across trackers, with figures reported between roughly 394 and 421 depending on methodology. We cite ~421 as the commonly reported figure.
• CVSS scores for Chrome's August fixes were not yet finalized in NVD at time of writing; Google's own severity rating (Critical) is used as a placeholder.
• 7-Zip's CVE-2026-58052 carries a low CVSS score (4.8) despite real-world exploitation signal — a reminder that CVSS alone doesn't capture practical risk, especially for a flaw with no patch and no auto-update.
• Install base figures are vendor/estimate-based, not audited active-user counts.
• This index is editorial, not a complete vulnerability database. Always verify against NVD, the CISA KEV catalog, and vendor advisories before acting in a professional or enterprise context.

The complete, continuously-updated UpdateStar Vulnerability Index is available at client.updatestar.com.

This report is published monthly by UpdateStar as part of the UpdateStar Vulnerability Index series.

→ All software pages, version checks, alternatives comparisons, and the UpdateStar client download are available at updatestar.com.