BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//Patch Sonar//CISA patch deadlines//EN
CALSCALE:GREGORIAN
METHOD:PUBLISH
X-WR-CALNAME:Patch Sonar deadlines: Phones & computers
X-WR-CALDESC:Federal fix deadlines for actively exploited vulnerabilities\,
  from CISA's KEV catalog. patchsonar.com
REFRESH-INTERVAL;VALUE=DURATION:PT6H
X-PUBLISHED-TTL:PT6H
BEGIN:VEVENT
UID:CVE-2026-96951@patchsonar.com
DTSTAMP:20261013T000000Z
DTSTART;VALUE=DATE:20261016
DTEND;VALUE=DATE:20261017
SUMMARY:Patch deadline: Microsoft Windows (CVE-2026-96951)
DESCRIPTION:Microsoft Windows Command Injection Vulnerability\n\nMicrosoft 
 Windows Shell contains a command injection vulnerability that allows an un
 authorized attacker to bypass a security feature over a network.\n\nCISA's
  required action: Apply mitigations in accordance with vendor instructions
 \, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updat
 es Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Tri
 age Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidan
 ce for cloud services or discontinue use of the product if mitigations are
  unavailable. Stakeholders are responsible for evaluating each asset's int
 ernet exposure and ensuring adherence to BOD 26-04 patching guidelines.\n\
 nListed by CISA on 2026-10-13. More: https://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-96951
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-86950@patchsonar.com
DTSTAMP:20260929T000000Z
DTSTART;VALUE=DATE:20261013
DTEND;VALUE=DATE:20261014
SUMMARY:Patch deadline: Apple Multiple Products (CVE-2026-86950)
DESCRIPTION:Apple Multiple Products Out-of-Bounds Write Vulnerability\n\nAp
 ple iOS\, macOS\, and iPadOS contain an out-of-bounds write vulnerability 
 in CoreGraphics that may lead to arbitrary code execution.\n\nCISA's requi
 red action: Apply mitigations in accordance with vendor instructions\, ens
 uring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Bas
 ed on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Re
 quirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for
  cloud services or discontinue use of the product if mitigations are unava
 ilable. Stakeholders are responsible for evaluating each asset's internet 
 exposure and ensuring adherence to BOD 26-04 patching guidelines.\n\nListe
 d by CISA on 2026-09-29. More: https://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-86950
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-58704@patchsonar.com
DTSTAMP:20260916T000000Z
DTSTART;VALUE=DATE:20260919
DTEND;VALUE=DATE:20260920
SUMMARY:Patch deadline: Google Pixel (CVE-2026-58704)
DESCRIPTION:Google Pixel Improper Authorization Vulnerability\n\nGoogle Pix
 el devices contain an improper authorization vulnerability in the cellular
  modem. A logic error may allow an attacker to bypass permission checks an
 d escalate privileges.\n\nCISA's required action: Apply mitigations in acc
 ordance with vendor instructions\, ensuring compliance with CISA’s BOD 2
 6-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidan
 ce and CISA’s “Forensics Triage Requirements” (see URL in Notes). Fo
 llow applicable BOD 26-04 guidance for cloud services or discontinue use o
 f the product if mitigations are unavailable. Stakeholders are responsible
  for evaluating each asset's internet exposure and ensuring adherence to B
 OD 26-04 patching guidelines.\n\nListed by CISA on 2026-09-16. More: https
 ://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-58704
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-81963@patchsonar.com
DTSTAMP:20260908T000000Z
DTSTART;VALUE=DATE:20260922
DTEND;VALUE=DATE:20260923
SUMMARY:Patch deadline: Microsoft Windows (CVE-2026-81963)
DESCRIPTION:Microsoft Windows Link Following Vulnerability\n\nMicrosoft Win
 dows Update Stack contains a link following vulnerability that allows a lo
 cal attacker to escalate privileges locally up to SYSTEM.\n\nCISA's requir
 ed action: Apply mitigations in accordance with vendor instructions\, ensu
 ring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Base
 d on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Req
 uirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for 
 cloud services or discontinue use of the product if mitigations are unavai
 lable. Stakeholders are responsible for evaluating each asset's internet e
 xposure and ensuring adherence to BOD 26-04 patching guidelines.\n\nListed
  by CISA on 2026-09-08. More: https://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-81963
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-85880@patchsonar.com
DTSTAMP:20260908T000000Z
DTSTART;VALUE=DATE:20260922
DTEND;VALUE=DATE:20260923
SUMMARY:Patch deadline: Microsoft Windows (CVE-2026-85880)
DESCRIPTION:Microsoft Windows Heap-Based Buffer Overflow Vulnerability\n\nM
 icrosoft Windows Advanced Local Procedure Call contains a heap-based buffe
 r overflow vulnerability that allows an attacker to elevate privileges loc
 ally.\n\nCISA's required action: Apply mitigations in accordance with vend
 or instructions\, ensuring compliance with CISA’s BOD 26-04 Prioritizing
  Security Updates Based on Risk (see URL in Notes) guidance and CISA’s 
 “Forensics Triage Requirements” (see URL in Notes). Follow applicable 
 BOD 26-04 guidance for cloud services or discontinue use of the product if
  mitigations are unavailable. Stakeholders are responsible for evaluating 
 each asset's internet exposure and ensuring adherence to BOD 26-04 patchin
 g guidelines.\n\nListed by CISA on 2026-09-08. More: https://patchsonar.co
 m/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-85880
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-33824@patchsonar.com
DTSTAMP:20260818T000000Z
DTSTART;VALUE=DATE:20260821
DTEND;VALUE=DATE:20260822
SUMMARY:Patch deadline: Microsoft Internet Key Exchange (IKE) Service Exten
 sions (CVE-2026-33824)
DESCRIPTION:Microsoft Internet Key Exchange (IKE) Service Extensions Double
  Free Vulnerability\n\nMicrosoft Internet Key Exchange (IKE) Service Exten
 sions contains a double free vulnerability that could enable remote code e
 xecution.\n\nCISA's required action: Apply mitigations in accordance with 
 vendor instructions\, ensuring compliance with CISA’s BOD 26-04 Prioriti
 zing Security Updates Based on Risk (see URL in Notes) guidance and CISA
 ’s “Forensics Triage Requirements” (see URL in Notes). Follow applic
 able BOD 26-04 guidance for cloud services or discontinue use of the produ
 ct if mitigations are unavailable. Stakeholders are responsible for evalua
 ting each asset's internet exposure and ensuring adherence to BOD 26-04 pa
 tching guidelines.\n\nListed by CISA on 2026-08-18. More: https://patchson
 ar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-33824
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-65400@patchsonar.com
DTSTAMP:20260818T000000Z
DTSTART;VALUE=DATE:20260821
DTEND;VALUE=DATE:20260822
SUMMARY:Patch deadline: Apple macOS (CVE-2026-65400)
DESCRIPTION:Apple macOS Improper Authentication Vulnerability\n\nApple macO
 S contains an improper authentication vulnerability that could allow an at
 tacker on the network to authenticate to Screen Sharing without valid cred
 entials.\n\nCISA's required action: Apply mitigations in accordance with v
 endor instructions\, ensuring compliance with CISA’s BOD 26-04 Prioritiz
 ing Security Updates Based on Risk (see URL in Notes) guidance and CISA’
 s “Forensics Triage Requirements” (see URL in Notes). Follow applicabl
 e BOD 26-04 guidance for cloud services or discontinue use of the product 
 if mitigations are unavailable. Stakeholders are responsible for evaluatin
 g each asset's internet exposure and ensuring adherence to BOD 26-04 patch
 ing guidelines.\n\nListed by CISA on 2026-08-18. More: https://patchsonar.
 com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-65400
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-68820@patchsonar.com
DTSTAMP:20260811T000000Z
DTSTART;VALUE=DATE:20260825
DTEND;VALUE=DATE:20260826
SUMMARY:Patch deadline: Microsoft Windows Ancillary Function Driver for Win
 Sock  (CVE-2026-68820)
DESCRIPTION:Microsoft Windows Ancillary Function Driver for WinSock Use-Aft
 er-Free Vulnerability\n\nMicrosoft Windows Ancillary Function Driver for W
 inSock contains a use-after-free vulnerability that allows an authorized a
 ttacker to elevate privileges locally.\n\nCISA's required action: Apply mi
 tigations in accordance with vendor instructions\, ensuring compliance wit
 h CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL 
 in Notes) guidance and CISA’s “Forensics Triage Requirements” (see U
 RL in Notes). Follow applicable BOD 26-04 guidance for cloud services or d
 iscontinue use of the product if mitigations are unavailable. Stakeholders
  are responsible for evaluating each asset's internet exposure and ensurin
 g adherence to BOD 26-04 patching guidelines.\n\nListed by CISA on 2026-08
 -11. More: https://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-68820
TRANSP:TRANSPARENT
END:VEVENT
END:VCALENDAR