BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//Patch Sonar//CISA patch deadlines//EN
CALSCALE:GREGORIAN
METHOD:PUBLISH
X-WR-CALNAME:Patch Sonar deadlines: Other business software
X-WR-CALDESC:Federal fix deadlines for actively exploited vulnerabilities\,
  from CISA's KEV catalog. patchsonar.com
REFRESH-INTERVAL;VALUE=DURATION:PT6H
X-PUBLISHED-TTL:PT6H
BEGIN:VEVENT
UID:CVE-2026-106931@patchsonar.com
DTSTAMP:20261020T000000Z
DTSTART;VALUE=DATE:20261023
DTEND;VALUE=DATE:20261024
SUMMARY:Patch deadline: EG Secure Solutions SiteGuard Server Edition (CVE-2
 026-106931)
DESCRIPTION:EG Secure Solutions SiteGuard Server Edition OS Command Injecti
 on Vulnerability\n\nEG Secure Solutions SiteGuard Server Edition contains 
 an OS command injection vulnerability which may allow an attacker to execu
 te arbitrary OS commands with root or SYSTEM privileges on the system runn
 ing the affected product.\n\nCISA's required action: Apply mitigations in 
 accordance with vendor instructions\, ensuring compliance with CISA’s BO
 D 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) gui
 dance and CISA’s “Forensics Triage Requirements” (see URL in Notes).
  Follow applicable BOD 26-04 guidance for cloud services or discontinue us
 e of the product if mitigations are unavailable. Stakeholders are responsi
 ble for evaluating each asset's internet exposure and ensuring adherence t
 o BOD 26-04 patching guidelines.\n\nListed by CISA on 2026-10-20. More: ht
 tps://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-106931
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-110936@patchsonar.com
DTSTAMP:20261020T000000Z
DTSTART;VALUE=DATE:20261103
DTEND;VALUE=DATE:20261104
SUMMARY:Patch deadline: Siemens Software Center (CVE-2026-110936)
DESCRIPTION:Siemens Software Center Uncontrolled Search Path Element Vulner
 ability\n\nSiemens Software Center contains an uncontrolled search path el
 ement vulnerability that could allow an authenticated local attacker to pl
 ace a specially crafted DLL in a directory that the application searches\,
  leading to arbitrary code execution with the privileges of the affected a
 pplication.\n\nCISA's required action: Apply mitigations in accordance wit
 h vendor instructions\, ensuring compliance with CISA’s BOD 26-04 Priori
 tizing Security Updates Based on Risk (see URL in Notes) guidance and CISA
 ’s “Forensics Triage Requirements” (see URL in Notes). Follow applic
 able BOD 26-04 guidance for cloud services or discontinue use of the produ
 ct if mitigations are unavailable. Stakeholders are responsible for evalua
 ting each asset's internet exposure and ensuring adherence to BOD 26-04 pa
 tching guidelines.\n\nListed by CISA on 2026-10-20. More: https://patchson
 ar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-110936
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-96652@patchsonar.com
DTSTAMP:20261020T000000Z
DTSTART;VALUE=DATE:20261103
DTEND;VALUE=DATE:20261104
SUMMARY:Patch deadline: Plex Media Server (CVE-2026-96652)
DESCRIPTION:Plex Media Server Server-Side Request Forgery (SSRF) Vulnerabil
 ity\n\nPlex Media Server contains a server-side request forgery (SSRF) vul
 nerability which could allow an attacker using any X-Plex-Token value to i
 nclude a full URL in the 'protocol' parameter and force the Plex server to
  POST to the attacker's chosen destination. This vulnerability can be chai
 ned with CVE-2026-96654\, CVE-2026-96655\, and CVE-2026-96656. \n\nCISA's 
 required action: Apply mitigations in accordance with vendor instructions\
 , ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Update
 s Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Tria
 ge Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidanc
 e for cloud services or discontinue use of the product if mitigations are 
 unavailable. Stakeholders are responsible for evaluating each asset's inte
 rnet exposure and ensuring adherence to BOD 26-04 patching guidelines.\n\n
 Listed by CISA on 2026-10-20. More: https://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-96652
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-96654@patchsonar.com
DTSTAMP:20261020T000000Z
DTSTART;VALUE=DATE:20261023
DTEND;VALUE=DATE:20261024
SUMMARY:Patch deadline: Plex Media Server (CVE-2026-96654)
DESCRIPTION:Plex Media Server Improper Neutralization of Encoded URI Scheme
 s in a Web Page Vulnerability\n\nPlex Media Server contains an improper ne
 utralization of encoded URI schemes in a web page vulnerability that could
  allow an attacker to call other plugins' functions and supply their own p
 arameters. This vulnerability can be chained with CVE-2026-96652\, CVE-202
 6-96655\, and CVE-2026-96656.\n\nCISA's required action: Apply mitigations
  in accordance with vendor instructions\, ensuring compliance with CISA’
 s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes)
  guidance and CISA’s “Forensics Triage Requirements” (see URL in Not
 es). Follow applicable BOD 26-04 guidance for cloud services or discontinu
 e use of the product if mitigations are unavailable. Stakeholders are resp
 onsible for evaluating each asset's internet exposure and ensuring adheren
 ce to BOD 26-04 patching guidelines.\n\nListed by CISA on 2026-10-20. More
 : https://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-96654
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-96655@patchsonar.com
DTSTAMP:20261020T000000Z
DTSTART;VALUE=DATE:20261103
DTEND;VALUE=DATE:20261104
SUMMARY:Patch deadline: Plex Media Server (CVE-2026-96655)
DESCRIPTION:Plex Media Server Server-Side Request Forgery (SSRF) Vulnerabil
 ity\n\nPlex Media Server contains a server-side request forgery (SSRF) vul
 nerability that could allow an authenticated user to request arbitrary int
 ernal or external addresses via the '/video/:/transcode/universal' path pa
 rameter. This vulnerability can be chained with CVE-2026-96652\, CVE-2026-
 96654\, and CVE-2026-96656.\n\nCISA's required action: Apply mitigations i
 n accordance with vendor instructions\, ensuring compliance with CISA’s 
 BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) g
 uidance and CISA’s “Forensics Triage Requirements” (see URL in Notes
 ). Follow applicable BOD 26-04 guidance for cloud services or discontinue 
 use of the product if mitigations are unavailable. Stakeholders are respon
 sible for evaluating each asset's internet exposure and ensuring adherence
  to BOD 26-04 patching guidelines.\n\nListed by CISA on 2026-10-20. More: 
 https://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-96655
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-96656@patchsonar.com
DTSTAMP:20261020T000000Z
DTSTART;VALUE=DATE:20261023
DTEND;VALUE=DATE:20261024
SUMMARY:Patch deadline: Plex Media Server (CVE-2026-96656)
DESCRIPTION:Plex Media Server External Control of File Name or Path Vulnera
 bility\n\nPlex Media Server contains an external control of file name or p
 ath vulnerability which can allow an admin user to write arbitrary files t
 hat may be executed on load. This vulnerability can be chained with CVE-20
 26-96652\, CVE-2026-96654\, and CVE-2026-96655.\n\nCISA's required action:
  Apply mitigations in accordance with vendor instructions\, ensuring compl
 iance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk 
 (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements
 ” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud ser
 vices or discontinue use of the product if mitigations are unavailable. St
 akeholders are responsible for evaluating each asset's internet exposure a
 nd ensuring adherence to BOD 26-04 patching guidelines.\n\nListed by CISA 
 on 2026-10-20. More: https://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-96656
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-102489@patchsonar.com
DTSTAMP:20261002T000000Z
DTSTART;VALUE=DATE:20261005
DTEND;VALUE=DATE:20261006
SUMMARY:Patch deadline: Zammad GmbH Zammad (CVE-2026-102489)
DESCRIPTION:Zammad GmbH Zammad Session Fixation Vulnerability\n\nZammad Gmb
 H Zammad contains a session fixation vulnerability that can lead to remote
  code execution as the zammad user. This vulnerability can be chained with
  CVE-2026-102490.\n\nCISA's required action: Apply mitigations in accordan
 ce with vendor instructions\, ensuring compliance with CISA’s BOD 26-04 
 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance an
 d CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow 
 applicable BOD 26-04 guidance for cloud services or discontinue use of the
  product if mitigations are unavailable. Stakeholders are responsible for 
 evaluating each asset's internet exposure and ensuring adherence to BOD 26
 -04 patching guidelines.\n\nListed by CISA on 2026-10-02. More: https://pa
 tchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-102489
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-102490@patchsonar.com
DTSTAMP:20261002T000000Z
DTSTART;VALUE=DATE:20261005
DTEND;VALUE=DATE:20261006
SUMMARY:Patch deadline: Zammad GmbH Zammad (CVE-2026-102490)
DESCRIPTION:Zammad GmbH Zammad Improper Privilege Management Vulnerability\
 n\nZammad GmbH Zammad contains an improper privilege management vulnerabil
 ity that can allow the local zammad user to escalate privileges to root. T
 his vulnerability can be chained with CVE-2026-102489.\n\nCISA's required 
 action: Apply mitigations in accordance with vendor instructions\, ensurin
 g compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based o
 n Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requir
 ements” (see URL in Notes). Follow applicable BOD 26-04 guidance for clo
 ud services or discontinue use of the product if mitigations are unavailab
 le. Stakeholders are responsible for evaluating each asset's internet expo
 sure and ensuring adherence to BOD 26-04 patching guidelines.\n\nListed by
  CISA on 2026-10-02. More: https://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-102490
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-9586@patchsonar.com
DTSTAMP:20260902T000000Z
DTSTART;VALUE=DATE:20260905
DTEND;VALUE=DATE:20260906
SUMMARY:Patch deadline: Sangoma Switchvox (CVE-2026-9586)
DESCRIPTION:Sangoma Switchvox SQL Injection Vulnerability\n\nSangoma Switch
 vox contains a SQL injection vulnerability which allows an unauthenticated
  remote attacker to execute arbitrary SQL statements against the backend P
 ostgreSQL database using a single crafted request\, including database ope
 rations and remote code execution.\n\nCISA's required action: Apply mitiga
 tions in accordance with vendor instructions\, ensuring compliance with CI
 SA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in N
 otes) guidance and CISA’s “Forensics Triage Requirements” (see URL i
 n Notes). Follow applicable BOD 26-04 guidance for cloud services or disco
 ntinue use of the product if mitigations are unavailable. Stakeholders are
  responsible for evaluating each asset's internet exposure and ensuring ad
 herence to BOD 26-04 patching guidelines.\n\nListed by CISA on 2026-09-02.
  More: https://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-9586
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-81578@patchsonar.com
DTSTAMP:20260831T000000Z
DTSTART;VALUE=DATE:20260914
DTEND;VALUE=DATE:20260915
SUMMARY:Patch deadline: PaperCut NG/MF (CVE-2026-81578)
DESCRIPTION:PaperCut NG/MF Missing Authentication for Critical Function Vul
 nerability\n\nPaperCut NG/MF contains a missing authentication for critica
 l function vulnerability which allows an unauthenticated remote attacker t
 o modify certain system configurations. This vulnerability can be chained 
 with CVE-2026-82078.\n\nCISA's required action: Apply mitigations in accor
 dance with vendor instructions\, ensuring compliance with CISA’s BOD 26-
 04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance
  and CISA’s “Forensics Triage Requirements” (see URL in Notes). Foll
 ow applicable BOD 26-04 guidance for cloud services or discontinue use of 
 the product if mitigations are unavailable. Stakeholders are responsible f
 or evaluating each asset's internet exposure and ensuring adherence to BOD
  26-04 patching guidelines.\n\nListed by CISA on 2026-08-31. More: https:/
 /patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-81578
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-82078@patchsonar.com
DTSTAMP:20260831T000000Z
DTSTART;VALUE=DATE:20260914
DTEND;VALUE=DATE:20260915
SUMMARY:Patch deadline: PaperCut NG/MF (CVE-2026-82078)
DESCRIPTION:PaperCut NG/MF Unsafe Reflection Vulnerability\n\nPaperCut NG/M
 F contains an unsafe reflection vulnerability that allows an attacker to m
 anipulate system configuration parameters and execute arbitrary Java bytec
 ode residing on the application classpath under the security context of th
 e PaperCut server process. This vulnerability can be chained with CVE-2026
 -81578.\n\nCISA's required action: Apply mitigations in accordance with ve
 ndor instructions\, ensuring compliance with CISA’s BOD 26-04 Prioritizi
 ng Security Updates Based on Risk (see URL in Notes) guidance and CISA’s
  “Forensics Triage Requirements” (see URL in Notes). Follow applicable
  BOD 26-04 guidance for cloud services or discontinue use of the product i
 f mitigations are unavailable. Stakeholders are responsible for evaluating
  each asset's internet exposure and ensuring adherence to BOD 26-04 patchi
 ng guidelines.\n\nListed by CISA on 2026-08-31. More: https://patchsonar.c
 om/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-82078
TRANSP:TRANSPARENT
END:VEVENT
END:VCALENDAR