UpdateStar Vulnerability Index · October 2026

Monthly severity snapshot for widely-installed consumer software

74
Overall Score

HIGH

October 2026 is a step down from September's record month, but far from quiet. For the first time since summer, no browser zero-day was exploited. Attackers instead turned to a Windows Shell flaw that strips the Mark-of-the-Web warning from downloaded files, and to Plex Media Server, whose four-bug "Plex2Shell" chain was mass-exploited the day after a public proof-of-concept appeared. All five flaws are now on CISA KEV. Microsoft broke its own record again with about 1,411 CVEs in a single Patch Tuesday, more than in any previous full year, including five Outlook bugs rated CVSS 9.8 that trigger from the Reading Pane. WinRAR's 2025 path-traversal flaw is in its 15th month of active abuse, and Windows 11 24H2 Home and Pro reached end of support on October 13.

5 × KEV Listed Public PoC → ITW in 24 h 0 Browser Zero-Days ~1,411 MS CVEs · Record

Top 5 — Consumer App Severity

#1
Microsoft Windows (Shell) CVE-2026-96951
Command injection in Windows Shell that bypasses Mark-of-the-Web, so downloaded files open without the usual security warning · the only Microsoft zero-day under active attack in October · same bug class abused by DarkGate and other malware operators since 2024
CISA KEV Exploited ITW Patched Oct 13
8.8
CVSS HIGH
#2
Plex Media Server ("Plex2Shell") CVE-2026-96656 / -96652 / -96654 / -96655
Two SSRFs, a URL injection and an arbitrary file write chained into unauthenticated remote code execution · public PoC Oct 16, in-the-wild attacks from Oct 17 deploying crypto miners and residential-proxy malware · 36,000+ internet-exposed servers still unpatched in September, many on NAS boxes without auto-update
CISA KEV (×4) Exploited ITW Public PoC Patched 1.43.3.10861
8.6
CVSS HIGH
(chain 9.8)
#3
WinRAR CVE-2025-8088
Path traversal → Startup folder · Exploitation by state- and financially-motivated groups remains ongoing, incl. Russia-aligned campaigns against Ukraine (Gamaredon, SHADOW-EARTH-066) · No auto-update, ~500M users exposed
CISA KEV APT Active Patched 7.13
8.4
CVSS HIGH
#4
Microsoft Outlook / Office CVE-2026-70242 +4
Five Critical Outlook remote-code-execution bugs that trigger just by previewing an email in the Reading Pane · further 9.8 RCEs in Word and PowerPoint plus 20+ Critical Excel RCEs (8.8) · no known exploitation · Click-to-Run Office updates itself, MSI installs rely on Windows Update
Preview-Pane Vector Patched Oct 13
9.8
CVSS CRITICAL
#5
Google Chrome CVE-2026-106197 / -106358
Chrome 155 fixed 247 security bugs (4 Critical), including use-after-free flaws in Browser and Navigation that allow code execution outside the sandbox · a follow-up update on Oct 13 fixed 37 more (7 Critical) · no confirmed in-the-wild exploitation, auto-update reliable
Patched 155.0.8059.79/.80
Critical
CHROMIUM SEVERITY

CVSS Score Comparison

Windows (Shell) 8.8
Plex Media Server (chain 9.8) 8.6
WinRAR 8.4
Outlook 9.8
Chrome Critical*
MS CVE-2026-70242 (Outlook RCE, Reading Pane) 9.8
* Chromium severity rating; no NVD CVSS score published yet.

Key Stats — October 2026

~1,411
Microsoft CVEs patched in a single Patch Tuesday (all-time record, more than any previous full year)
5
New consumer-software entries on CISA KEV (1 Windows, 4 Plex)
1 day
From public Plex2Shell PoC to first in-the-wild exploitation
59
Potentially wormable Microsoft CVEs this month (ZDI)
−7
Days mean time-to-exploit (Mandiant M-Trends 2026)
43
Days median KEV remediation time (Verizon DBIR 2026)

Patch Lag — Days Since Disclosure vs. Update Status

WinRAR (CVE-2025-8088) 450+ d
Patched Jul 2025 · still under active nation-state exploitation 15 months later, no auto-update
Plex Media Server (Plex2Shell) ~80 d
Fixed Aug 3–4 · exploited from Oct 17, one day after the public PoC, while tens of thousands of servers were still unpatched
Windows (Shell) (CVE-2026-96951) ~11 d
Exploited as a zero-day; patched Oct 13 and added to CISA KEV the same day
Outlook (CVE-2026-70242 et al.) ~11 d
Patched Oct 13 · no known exploitation
Chrome (CVE-2026-106197) <7 d
Fixed Oct 6 / Oct 13 · auto-update reliable, restart to apply
Data sources: NVD · CISA KEV · Mandiant M-Trends 2026 · Verizon DBIR 2026 · vendor advisories (Microsoft MSRC, Google Chrome Releases, Mozilla, Plex, RARLAB) · Zero Day Initiative · Google Threat Intelligence Group · Shadowserver Foundation
Check and update all software at updatestar.com · Download the UpdateStar Client for Windows

October 2026 Highlights

  • KEV6 consumer-relevant CVEs on CISA Known Exploited Vulnerabilities list (5 new — Windows ×1, Plex ×4; 1 carryover — WinRAR)
  • PoCPlex2Shell went from public proof-of-concept to mass exploitation in about 24 hours
  • SUPPLYAOMEI Backupper / AnyViewer update servers were hijacked to push a backdoor (disclosed Oct 15 by Google)
  • GOODNo browser zero-days this month; Firefox 158 fixed 77 CVEs, Chrome 155 fixed 247
  • MS~1,411 Microsoft CVEs in a single Patch Tuesday — a new record for the second month running

Overall Severity Score

Index Score 74 / 100
Rating HIGH

App Quick Reference

  • CRIT Outlook / Office 9.8
  • CRIT Chrome Critical*
  • HIGH Windows (Shell) 8.8
  • HIGH Plex Media Server 8.6
  • HIGH WinRAR 8.4

Patch Status

  • Windows — patched Oct 13 (October cumulative update); 24H2 Home/Pro must upgrade to keep receiving fixes
  • Plex Media Server — patched in 1.43.3.10861+; check NAS installs manually, patching doesn't remove a compromise
  • WinRAR — patched but no auto-update, still actively exploited
  • Outlook / Office — patched Oct 13; Click-to-Run auto-updates, MSI via Windows Update
  • Chrome — patched (155.0.8059.79/.80, auto-update); no confirmed ITW, restart to apply

Data Sources

  • NVD (National Vulnerability Database)
  • CISA Known Exploited Vulnerabilities
  • Mandiant M-Trends 2026
  • Verizon DBIR 2026
  • Zero Day Initiative
  • Vendor security advisories