The UpdateStar Vulnerability Index — July 2026

Quick note before we start: every app mentioned in this report has a page on UpdateStar where you can check the current version, read the changelog, and download the latest release — links are inline throughout. If you'd rather have one tool watch all of this automatically, scroll to the bottom for our recommendation.

Here you can find the current UpdateStar Vulnerability Index.

TL;DR

There's no single browser zero-day dominating headlines this month. Instead, the story is a WinRAR bug from July 2025 that state-linked hacking groups are still actively exploiting a full year later, plus a Patch Tuesday so large it more than doubled June's already-record CVE count. Two of Microsoft's July flaws were exploited as zero-days before the patch shipped and landed on CISA's Known Exploited Vulnerabilities catalog within days.

The structural story hasn't changed since last month: patching is losing the race. Mandiant's M-Trends 2026 puts the mean time-to-exploit at negative seven days, attackers routinely strike before a fix even exists. Verizon's 2026 DBIR reports organizations take a median of 43 days to remediate known-exploited vulnerabilities, and only 26% of CISA KEV flaws get fully fixed at all. That gap is still the whole ballgame.

The Top 5 — July 2026

🔴 #1 — WinRAR

→ Check your WinRAR version and update on UpdateStar

CVE: CVE-2025-8088 · CVSS: 8.4 (NVD) · Status: Patched in WinRAR 7.13 — July 2025 · Still being actively exploited · On CISA KEV

This is now a full year old, and it's still here because the exploitation never stopped. The flaw is a path-traversal bug via crafted RAR archives using NTFS Alternate Data Streams, letting attackers drop a file directly into the Windows Startup folder — open the archive once, and the payload runs at the next reboot, no further interaction required. Google's Threat Intelligence Group described exploitation as "widespread and ongoing" as recently as June 2026, attributed to a long list of state-linked and financially-motivated groups including RomCom, Gamaredon, and Paper Werewolf.

WinRAR has no auto-update mechanism. RARLAB estimates roughly 500 million users worldwide, and a meaningful share of them are almost certainly still on a pre-7.13 build a year after the fix shipped, simply because nothing ever prompted them to update.

What to do: Download WinRAR 7.13 or later from UpdateStar and install it over your existing copy. If you haven't manually updated WinRAR in the past year, assume you're exposed.

🔴 #2 — Adobe Acrobat Reader

→ Check your Acrobat version and update on UpdateStar

CVE: CVE-2026-48373 · CVSS: 7.8 (High) · Status: Patched July 17, 2026 (APSB26-63) · No confirmed in-the-wild exploitation yet

A heap-based buffer overflow in Acrobat Reader that can lead to arbitrary code execution in the context of the current user. The catch is exploitation requires the victim to open a malicious file — the classic "PDF as a delivery mechanism" pattern this software has a well-documented history with. Adobe shipped the fix the same day the flaw was disclosed, which is faster than usual for this product, and there's no confirmed exploitation in the wild yet. Given how often Acrobat vulnerabilities get weaponized after quiet disclosure, "not yet" is worth taking seriously rather than as reassurance.

What to do: Open Acrobat, go to Help → Check for Updates, and confirm you're on 26.001.21662 / 24.001.30362 or later.

Worth considering: if you only need to read PDFs — not edit, sign, or use cloud features — a lighter reader with a smaller attack surface is a reasonable trade. UpdateStar's Adobe Reader alternatives page compares SumatraPDF, Foxit PDF Reader, and others.

🟠 #3 — Mozilla Firefox

→ Check your Firefox version and update on UpdateStar

CVEs: CVE-2026-15718 / CVE-2026-15719 (MFSA 2026-67) · CVSS: Critical (Mozilla rating; not yet published by NVD at time of writing) · Status: Patched in Firefox 152.0.6 · Public exploit code confirmed, no in-the-wild attacks observed

This is the one that should move unpatched users today rather than waiting for the background update. Mozilla's own advisory states plainly: "We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw" — for both CVEs. CVE-2026-15718 is an invalid-pointer bug in the JavaScript/WebAssembly engine. CVE-2026-15719 is more structurally interesting: a flaw in how DOM navigation enforces Firefox's Fission site-isolation boundary, the architecture that's supposed to keep a compromised tab from reading data out of a different tab's process. That's not routine memory-safety housekeeping — it's a defeat of the isolation guarantee itself.

Firefox downloads updates in the background but only applies them on restart. A browser left open for days, which is common behavior, simply won't have the fix yet.

What to do: Restart Firefox. That's it — the update installs on relaunch. Confirm you land on 152.0.6 or later afterward.

🟠 #4 — Google Chrome

→ Check your Chrome version and update on UpdateStar

CVEs: CVE-2026-15764 / CVE-2026-15765 · CVSS: Critical (vendor rating; not yet published by NVD at time of writing) · Status: Patched in Chrome 150.0.7871.124/.125 · No confirmed exploitation at time of disclosure

Two critical use-after-free flaws in Chrome's Ozone layer — the abstraction that lets the browser talk to the underlying operating system's windowing and display stack (X11, Wayland, DRM on Linux; the ChromeOS and Fuchsia display stacks). Because Ozone sits closer to the OS trust boundary than a typical in-browser renderer bug, a use-after-free here has a more direct path toward sandbox escape than the average Chrome memory-safety issue. Google withheld technical detail pending broader rollout, standard practice to slow weaponization, and as of disclosure neither flaw had confirmed active exploitation.

Chrome distributes updates on a staged rollout, so a browser left open continuously may not receive the fix for days even after release.

What to do: Open the three-dot menu → Help → About Google Chrome to force an immediate update check, then restart. Confirm you land on 150.0.7871.124/.125 or later. Edge, Brave, Vivaldi, and Opera users should force-update their Chromium-based browsers too.

Considering alternatives? UpdateStar's Chrome alternatives comparison covers Firefox, Brave, and Vivaldi — though most Chromium-based options share the same underlying engine and inherit the same class of bug.

🟡 #5 — 7-Zip

→ Check your 7-Zip version and update on UpdateStar

CVE: CVE-2026-14266 · CVSS: 7.0 (High) · Status: Silently patched in 7-Zip 26.02 (June 25) · ZDI advisory published July 15 · No confirmed PoC or in-the-wild exploitation

A heap-corruption bug in how 7-Zip processes XZ-compressed chunked data during decompression — a crafted XZ archive can overflow a heap-based buffer during extraction. The fix actually shipped back on June 25, quietly, but the Zero Day Initiative's advisory (ZDI-26-444) didn't make the technical details public until July 15, roughly three weeks later. There's no confirmed proof-of-concept or active exploitation as of this writing, which is the main reason it sits at the bottom of this month's list rather than higher.

7-Zip has no auto-update. As with WinRAR, that means the fix existing doesn't tell you much about how many installs actually have it.

What to do: Download 7-Zip 26.02 or later directly from UpdateStar and install it over your existing copy.

Honorable Mentions

Microsoft (Patch Tuesday, July 8–15): The largest single-month security release in Microsoft's history. Multiple independent trackers (Tenable, CrowdStrike, BleepingComputer, Ivanti) converge on 569 CVEs, 56 of them critical — more than 2.5× June's previous record of 208. (A few outlets, including Zero Day Initiative and Security Affairs, report 621–622, likely counting a broader advisory scope; see caveats below.) Two flaws were exploited as zero-days and added to CISA KEV within days: CVE-2026-56155 (Active Directory Federation Services elevation of privilege, CVSS 7.8) and CVE-2026-56164 (SharePoint Server elevation of privilege, CVSS 5.3). The highest CVSS score of the month belongs to CVE-2026-57092, a Windows VMSwitch elevation-of-privilege bug rated 9.9 that lets a low-privileged attacker inside a VM escalate to full host compromise — not confirmed exploited yet, but exactly the kind of bug that keeps virtualization admins up at night.

Zoom: CVE-2026-53412, a critical improper input-validation flaw in Zoom Workplace for Windows (ZSB-26014), was patched this month. No in-the-wild exploitation reported, but worth checking your organization's deployment is current given Zoom's enterprise footprint.

The Patch-Lag Picture

The number that matters most hasn't moved, and that's the problem: mean time-to-exploit is still -7 days (Mandiant M-Trends 2026) — attackers are, on average, exploiting vulnerabilities before patches exist. Verizon's 2026 DBIR finds median KEV remediation now takes 43 days, up from 32 the year before, and only 26% of known-exploited vulnerabilities get fully remediated.

Software that auto-updates silently (Chrome, Firefox) closes that gap on its own, provided the user eventually restarts the app. Software that doesn't (7-Zip, WinRAR) leaves the gap entirely in the user's hands — and WinRAR's CVE-2025-8088 is the clearest possible illustration of what happens when nobody closes it: a year of continuous nation-state exploitation of a bug that's had a fix available the entire time.

The Honest Recommendation: Use the UpdateStar Client

The single most practical thing most Windows users can do, beyond enabling auto-update wherever it exist, is install a tool that watches the software that doesn't.

→ Download the UpdateStar Client for Windows

The UpdateStar client monitors your installed software against UpdateStar's database and notifies you when updates are available, covering exactly the category-two problem above: the 7-Zips and WinRARs of the world that will never tell you they need updating. The Premium Edition adds CVE-level risk context for your installed apps and validates download sources.

Caveats and Methodology

• Microsoft's July CVE count is genuinely disputed. Tenable, CrowdStrike, BleepingComputer, and Ivanti report 569; Zero Day Initiative and Security Affairs report 621–622, likely reflecting a broader advisory scope (Extended Security Updates, third-party Chromium CVEs republished via MSRC). We cite 569 as the more conservative, multiply-corroborated figure and flag the range rather than picking one silently.
• Chrome and Firefox CVSS scores were not yet published in NVD as of this writing. Both vendors rate their July flaws "Critical"; we show that rather than inventing a numeric score.
• WinRAR is carried forward from June because CVE-2025-8088 remains the most consequential ongoing consumer-software exploitation story, not because nothing newer exists — a second, newer WinRAR flaw (CVE-2026-14191, CVSS 7.8, patched in 7.23) was also fixed this month but hasn't reached the same exploitation profile.
• This index is editorial, not a complete vulnerability database. Always verify against NVD, the CISA KEV catalog, and vendor advisories before acting in a professional or enterprise context.

The complete UpdateStar Vulnerability Index.

→ All software pages, version checks, alternatives comparisons, and the UpdateStar client download are available at updatestar.com.