# Most vulnerable technologies: week of 12 to 18 October 2026 (week 42)

Source: https://junglewise.ai/threats/weekly/2026-10-12  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 20 October 2026, 00:07 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/weekly/2026-10-12.json  
License: CC BY 4.0 with a link back

In the week of 12 to 18 October 2026, Junglewise Threat Intelligence recorded 4,638 new vulnerabilities: 274 critical, 1,770 high and 5 exploited in the wild. The most vulnerable technology was Microsoft Windows, with 618 vulnerabilities (20 critical, 1 exploited in the wild), followed by Microsoft Windows Server 2025 (212) and Microsoft Windows 11 26h2 (197).

## Ranking

| # | Technology | Vulns | Critical | High | Exploited | Max CVSS |
| --- | --- | --- | --- | --- | --- | --- |
| 1 | [Microsoft Windows](https://junglewise.ai/threats/technologies/windows-) (Microsoft) | 618 | 20 | 457 | 1 | 9.8 |
| 2 | [Microsoft Windows Server 2025](https://junglewise.ai/threats/technologies/windows-server-2025) (Microsoft) | 212 | 15 | 127 | 1 | 9.8 |
| 3 | [Microsoft Windows 11 26h2](https://junglewise.ai/threats/technologies/windows-11-26h2) (Microsoft) | 197 | 11 | 130 | 1 | 9.8 |
| 4 | [Microsoft Windows Server 2022](https://junglewise.ai/threats/technologies/windows-server-2022) (Microsoft) | 200 | 15 | 117 | 1 | 9.8 |
| 5 | [Microsoft Windows 11 24h2](https://junglewise.ai/threats/technologies/windows-11-24h2) (Microsoft) | 196 | 11 | 129 | 1 | 9.8 |
| 6 | [Microsoft Windows 11 25h2](https://junglewise.ai/threats/technologies/windows-11-25h2) (Microsoft) | 196 | 11 | 129 | 1 | 9.8 |
| 7 | [Microsoft Windows 11 26h1](https://junglewise.ai/threats/technologies/windows-11-26h1) (Microsoft) | 192 | 11 | 124 | 1 | 9.8 |
| 8 | [Linux Kernel](https://junglewise.ai/threats/technologies/kernel) (Linux) | 481 | 0 | 4 | 0 | 8.8 |
| 9 | [Microsoft Windows 11 23h2](https://junglewise.ai/threats/technologies/windows-11-23h2) (Microsoft) | 181 | 11 | 117 | 1 | 9.8 |
| 10 | [Microsoft Windows Server 2019](https://junglewise.ai/threats/technologies/windows-server-2019) (Microsoft) | 183 | 13 | 106 | 1 | 9.8 |
| 11 | [Microsoft Windows 10 1809](https://junglewise.ai/threats/technologies/windows-10-1809) (Microsoft) | 173 | 12 | 105 | 1 | 9.8 |
| 12 | [Microsoft Windows 10 21h2](https://junglewise.ai/threats/technologies/windows-10-21h2) (Microsoft) | 168 | 9 | 110 | 1 | 9.8 |
| 13 | [Microsoft Windows 10 22h2](https://junglewise.ai/threats/technologies/windows-10-22h2) (Microsoft) | 167 | 9 | 109 | 1 | 9.8 |
| 14 | [Microsoft Windows Server 2016](https://junglewise.ai/threats/technologies/windows-server-2016) (Microsoft) | 156 | 10 | 85 | 1 | 9.8 |
| 15 | [Microsoft Windows 10 1607](https://junglewise.ai/threats/technologies/windows-10-1607) (Microsoft) | 149 | 10 | 85 | 1 | 9.8 |
| 16 | [Microsoft Windows Server 2012](https://junglewise.ai/threats/technologies/windows-server-2012) (Microsoft) | 140 | 10 | 72 | 1 | 9.8 |
| 17 | [Google Chrome](https://junglewise.ai/threats/technologies/chrome) (Google) | 47 | 7 | 31 | 0 | 9.6 |
| 18 | [Juniper Networks Junos OS](https://junglewise.ai/threats/technologies/juniper-networks-junos-os) (Juniper Networks) | 44 | 5 | 36 | 0 | 9.8 |
| 19 | [Juniper Networks Junos OS Evolved](https://junglewise.ai/threats/technologies/junos-os-evolved) (Juniper Networks) | 41 | 5 | 33 | 0 | 9.8 |
| 20 | [Mozilla Thunderbird](https://junglewise.ai/threats/technologies/thunderbird) (Mozilla) | 80 | 4 | 10 | 0 | 9.6 |
| 21 | [Mozilla Firefox](https://junglewise.ai/threats/technologies/firefox) (Mozilla) | 77 | 4 | 10 | 0 | 9.6 |
| 22 | [Progress Marklogic Server](https://junglewise.ai/threats/technologies/marklogic-server) (Progress) | 31 | 5 | 24 | 0 | 9.9 |
| 23 | [Frappe ERPNext](https://junglewise.ai/threats/technologies/erpnext) (Frappe) | 70 | 0 | 15 | 0 | 8.8 |
| 24 | [Adobe ColdFusion](https://junglewise.ai/threats/technologies/coldfusion) (Adobe) | 25 | 8 | 17 | 0 | 10 |
| 25 | [Mozilla Firefox ESR](https://junglewise.ai/threats/technologies/firefox-esr) (Mozilla) | 61 | 3 | 9 | 0 | 9.6 |

## Most affected vendors

1. [Microsoft](https://junglewise.ai/threats/vendors/microsoft): 1,159 vulnerabilities, 47 critical, 1 exploited
2. [Linux](https://junglewise.ai/threats/vendors/linux): 442 vulnerabilities, 0 critical, 0 exploited
3. [Adobe](https://junglewise.ai/threats/vendors/adobe): 140 vulnerabilities, 19 critical, 0 exploited
4. [IBM](https://junglewise.ai/threats/vendors/ibm): 85 vulnerabilities, 9 critical, 0 exploited
5. [Juniper Networks](https://junglewise.ai/threats/vendors/juniper-networks): 48 vulnerabilities, 6 critical, 0 exploited
6. [Progress](https://junglewise.ai/threats/vendors/progress): 55 vulnerabilities, 5 critical, 0 exploited
7. [Google](https://junglewise.ai/threats/vendors/google): 51 vulnerabilities, 7 critical, 0 exploited
8. [Frappe](https://junglewise.ai/threats/vendors/frappe): 93 vulnerabilities, 0 critical, 0 exploited
9. [Mozilla](https://junglewise.ai/threats/vendors/mozilla): 83 vulnerabilities, 4 critical, 0 exploited
10. [Siemens](https://junglewise.ai/threats/vendors/siemens): 33 vulnerabilities, 4 critical, 0 exploited

## Most severe vulnerabilities

- [CVE-2026-102764: BeyondTrust Remote Support authentication bypass by spoofing](https://junglewise.ai/threats/cve-2026-102764-beyondtrust-remote-support-authentication-bypass-by-spoofing) (critical, exploited in the wild, CVSS 9.8, published 15 Oct 2026)
- [CVE-2026-96951: Microsoft Windows command injection in Shell](https://junglewise.ai/threats/cve-2026-96951-microsoft-windows-command-injection-vulnerability) (critical, exploited in the wild, CVSS 8.8, published 13 Oct 2026)
- [CVE-2026-104935: Ivanti Connect Secure authentication bypass by spoofing](https://junglewise.ai/threats/cve-2026-104935-ivanti-connect-secure-authentication-bypass-by-spoofing) (critical, exploited in the wild, CVSS 8.6, published 13 Oct 2026)
- [CVE-2026-0322: Palo Alto Networks PAN-OS code injection vulnerability](https://junglewise.ai/threats/cve-2026-0322-palo-alto-networks-pan-os-code-injection-vulnerability) (critical, exploited in the wild, published 14 Oct 2026)
- [CVE-2026-76519: Cisco Secure Email Gateway relative path traversal](https://junglewise.ai/threats/cve-2026-76519-cisco-secure-email-gateway-relative-path-traversal-vulnerability) (critical, exploited in the wild, published 14 Oct 2026)
- [CVE-2026-108804: TRENDnet TEW-751DR/TEW-752DRU/TEW-733GR OS command injection in web management](https://junglewise.ai/threats/cve-2026-108804-a-vulnerability-was-detected-in-trendnet-tew-751dr-tew-752dru) (critical, CVSS 10, published 12 Oct 2026)
- [CVE-2026-109110: Wavlink WL-WN592AX6 OS command injection in wmapd daemon](https://junglewise.ai/threats/cve-2026-109110-a-flaw-has-been-found-in-wavlink-wl-wn592ax6-250422-this-issue) (critical, CVSS 10, published 13 Oct 2026)
- [CVE-2026-108918: Edimax BR-6208AC command injection in /goform/formWlanMP](https://junglewise.ai/threats/cve-2026-108918-a-vulnerability-was-identified-in-edimax-br-6208ac-1-32-impacted) (critical, CVSS 10, published 12 Oct 2026)
- [CVE-2026-108917: Edimax BR-6208AC command injection in /goform/formAutoFWupgrade](https://junglewise.ai/threats/cve-2026-108917-a-vulnerability-was-determined-in-edimax-br-6208ac-1-32-this) (critical, CVSS 10, published 12 Oct 2026)
- [CVE-2026-108907: Netcore NR268 authentication bypass in CGI execution](https://junglewise.ai/threats/cve-2026-108907-a-vulnerability-was-determined-in-netcore-nr268-1-7-121109) (critical, CVSS 10, published 12 Oct 2026)

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Most vulnerable technologies: week of 12 to 18 October 2026 (week 42)", https://junglewise.ai/threats/weekly/2026-10-12, 20 October 2026.