BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//Patch Sonar//CISA patch deadlines//EN
CALSCALE:GREGORIAN
METHOD:PUBLISH
X-WR-CALNAME:Patch Sonar deadlines: Firewalls\, VPNs & network gear
X-WR-CALDESC:Federal fix deadlines for actively exploited vulnerabilities\,
  from CISA's KEV catalog. patchsonar.com
REFRESH-INTERVAL;VALUE=DURATION:PT6H
X-PUBLISHED-TTL:PT6H
BEGIN:VEVENT
UID:CVE-2026-114625@patchsonar.com
DTSTAMP:20261023T000000Z
DTSTART;VALUE=DATE:20261026
DTEND;VALUE=DATE:20261027
SUMMARY:Patch deadline: Arista VeloCloud Orchestrator (CVE-2026-114625)
DESCRIPTION:Arista VeloCloud Orchestrator SQL Injection Vulnerability\n\nAr
 ista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability
  that may allow a remote attacker to access privileged internal functional
 ity and impact the VCO host. Successful exploitation may compromise the co
 nfidentiality\, integrity\, and availability of the orchestrator and data 
 managed by the orchestrator.\n\nCISA's required action: Apply mitigations 
 in accordance with vendor instructions\, ensuring compliance with CISA’s
  BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) 
 guidance and CISA’s “Forensics Triage Requirements” (see URL in Note
 s). Follow applicable BOD 26-04 guidance for cloud services or discontinue
  use of the product if mitigations are unavailable. Stakeholders are respo
 nsible for evaluating each asset's internet exposure and ensuring adherenc
 e to BOD 26-04 patching guidelines.\n\nListed by CISA on 2026-10-23. More:
  https://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-114625
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2025-61624@patchsonar.com
DTSTAMP:20261016T000000Z
DTSTART;VALUE=DATE:20261019
DTEND;VALUE=DATE:20261020
SUMMARY:Patch deadline: Fortinet Multiple Products (CVE-2025-61624)
DESCRIPTION:Fortinet Multiple Products Path Traversal Vulnerability\n\nFort
 iOS\, FortiPAM\, FortiProxy\, and FortiSwitchManager contain a path traver
 sal vulnerability that may allow an authenticated attacker with admin prof
 ile and at least read-write permissions to write or delete arbitrary files
  via specific CLI commands.\n\nCISA's required action: Apply mitigations i
 n accordance with vendor instructions\, ensuring compliance with CISA’s 
 BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) g
 uidance and CISA’s “Forensics Triage Requirements” (see URL in Notes
 ). Follow applicable BOD 26-04 guidance for cloud services or discontinue 
 use of the product if mitigations are unavailable. Stakeholders are respon
 sible for evaluating each asset's internet exposure and ensuring adherence
  to BOD 26-04 patching guidelines.\n\nListed by CISA on 2026-10-16. More: 
 https://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2025-61624
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-0322@patchsonar.com
DTSTAMP:20261014T000000Z
DTSTART;VALUE=DATE:20261017
DTEND;VALUE=DATE:20261018
SUMMARY:Patch deadline: Palo Alto Networks PAN-OS (CVE-2026-0322)
DESCRIPTION:Palo Alto Networks PAN-OS Code Injection Vulnerability\n\nPalo 
 Alto Networks PAN-OS contains a code injection vulnerability that could al
 low an authenticated attacker with network access to execute arbitrary cod
 e with root privileges on the firewall.\n\nCISA's required action: Apply m
 itigations in accordance with vendor instructions\, ensuring compliance wi
 th CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL
  in Notes) guidance and CISA’s “Forensics Triage Requirements” (see 
 URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or 
 discontinue use of the product if mitigations are unavailable. Stakeholder
 s are responsible for evaluating each asset's internet exposure and ensuri
 ng adherence to BOD 26-04 patching guidelines.\n\nListed by CISA on 2026-1
 0-14. More: https://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-0322
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-76519@patchsonar.com
DTSTAMP:20261014T000000Z
DTSTART;VALUE=DATE:20261017
DTEND;VALUE=DATE:20261018
SUMMARY:Patch deadline: Cisco Secure Email Gateway (CVE-2026-76519)
DESCRIPTION:Cisco Secure Email Gateway Relative Path Traversal Vulnerabilit
 y\n\nCisco Secure Email Gateway contains a relative path traversal vulnera
 bility that could allow an unauthenticated\, remote attacker to write arbi
 trary files on the underlying operating system.\n\nCISA's required action:
  Apply mitigations in accordance with vendor instructions\, ensuring compl
 iance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk 
 (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements
 ” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud ser
 vices or discontinue use of the product if mitigations are unavailable. St
 akeholders are responsible for evaluating each asset's internet exposure a
 nd ensuring adherence to BOD 26-04 patching guidelines.\n\nListed by CISA 
 on 2026-10-14. More: https://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-76519
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-104935@patchsonar.com
DTSTAMP:20261013T000000Z
DTSTART;VALUE=DATE:20261016
DTEND;VALUE=DATE:20261017
SUMMARY:Patch deadline: Ivanti Connect Secure (CVE-2026-104935)
DESCRIPTION:Ivanti Connect Secure Authentication Bypass by Spoofing Vulnera
 bility\n\nIvanti Connect Secure contains an authentication bypass by spoof
 ing vulnerability that allows a remote unauthenticated attacker to execute
  arbitrary commands.\n\nCISA's required action: Apply mitigations in accor
 dance with vendor instructions\, ensuring compliance with CISA’s BOD 26-
 04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance
  and CISA’s “Forensics Triage Requirements” (see URL in Notes). Foll
 ow applicable BOD 26-04 guidance for cloud services or discontinue use of 
 the product if mitigations are unavailable. Stakeholders are responsible f
 or evaluating each asset's internet exposure and ensuring adherence to BOD
  26-04 patching guidelines.\n\nListed by CISA on 2026-10-13. More: https:/
 /patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-104935
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-88779@patchsonar.com
DTSTAMP:20261004T000000Z
DTSTART;VALUE=DATE:20261007
DTEND;VALUE=DATE:20261008
SUMMARY:Patch deadline: Citrix NetScaler (CVE-2026-88779)
DESCRIPTION:Citrix NetScaler Improper Restriction of Operations within the 
 Bounds of a Memory Buffer Vulnerability\n\nCitrix NetScaler ADC (formerly 
 Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain
  an improper restriction of operations within the bounds of a memory buffe
 r vulnerability that could allow for a denial of service.\n\nCISA's requir
 ed action: Apply mitigations in accordance with vendor instructions\, ensu
 ring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Base
 d on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Req
 uirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for 
 cloud services or discontinue use of the product if mitigations are unavai
 lable. Stakeholders are responsible for evaluating each asset's internet e
 xposure and ensuring adherence to BOD 26-04 patching guidelines.\n\nListed
  by CISA on 2026-10-04. More: https://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-88779
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-104286@patchsonar.com
DTSTAMP:20261001T000000Z
DTSTART;VALUE=DATE:20261004
DTEND;VALUE=DATE:20261005
SUMMARY:Patch deadline: Fortinet FortiMail (CVE-2026-104286)
DESCRIPTION:Fortinet FortiMail Path Traversal Vulnerability\n\nFortinet For
 tiMail contains a path traversal and an improper neutralization of NULL by
 te or NULL character vulnerability that may allow an unauthenticated attac
 ker to write arbitrary files on the underlying system via crafted HTTP or 
 HTTPS requests.\n\nCISA's required action: Apply mitigations in accordance
  with vendor instructions\, ensuring compliance with CISA’s BOD 26-04 Pr
 ioritizing Security Updates Based on Risk (see URL in Notes) guidance and 
 CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow ap
 plicable BOD 26-04 guidance for cloud services or discontinue use of the p
 roduct if mitigations are unavailable. Stakeholders are responsible for ev
 aluating each asset's internet exposure and ensuring adherence to BOD 26-0
 4 patching guidelines.\n\nListed by CISA on 2026-10-01. More: https://patc
 hsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-104286
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-76504@patchsonar.com
DTSTAMP:20260930T000000Z
DTSTART;VALUE=DATE:20261003
DTEND;VALUE=DATE:20261004
SUMMARY:Patch deadline: Cisco Catalyst SD-WAN Manager (CVE-2026-76504)
DESCRIPTION:Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability\n\nCis
 co Catalyst SD-WAN Manager contains a hex encoding vulnerability that coul
 d allow an unauthenticated\, remote attacker to access an affected system 
 with privileges of the admin user due to improper handling of URI encoding
  in an HTTP request.\n\nCISA's required action: Apply mitigations in accor
 dance with vendor instructions\, ensuring compliance with CISA’s BOD 26-
 04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance
  and CISA’s “Forensics Triage Requirements” (see URL in Notes). Foll
 ow applicable BOD 26-04 guidance for cloud services or discontinue use of 
 the product if mitigations are unavailable. Stakeholders are responsible f
 or evaluating each asset's internet exposure and ensuring adherence to BOD
  26-04 patching guidelines.\n\nListed by CISA on 2026-09-30. More: https:/
 /patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-76504
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-88771@patchsonar.com
DTSTAMP:20260927T000000Z
DTSTART;VALUE=DATE:20260930
DTEND;VALUE=DATE:20261001
SUMMARY:Patch deadline: Citrix NetScaler (CVE-2026-88771)
DESCRIPTION:Citrix NetScaler Improper Input Validation Vulnerability\n\nCit
 rix NetScaler ADC and NetScaler Gateway contain an improper input validati
 on vulnerability that could allow an unauthenticated attacker to execute a
 rbitrary commands.\n\nCISA's required action: Apply mitigations in accorda
 nce with vendor instructions\, ensuring compliance with CISA’s BOD 26-04
  Prioritizing Security Updates Based on Risk (see URL in Notes) guidance a
 nd CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow
  applicable BOD 26-04 guidance for cloud services or discontinue use of th
 e product if mitigations are unavailable. Stakeholders are responsible for
  evaluating each asset's internet exposure and ensuring adherence to BOD 2
 6-04 patching guidelines.\n\nListed by CISA on 2026-09-27. More: https://p
 atchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-88771
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-88772@patchsonar.com
DTSTAMP:20260927T000000Z
DTSTART;VALUE=DATE:20260930
DTEND;VALUE=DATE:20261001
SUMMARY:Patch deadline: Citrix NetScaler (CVE-2026-88772)
DESCRIPTION:Citrix NetScaler Improper Restriction of Operations within the 
 Bounds of a Memory Buffer Vulnerability\n\nCitrix NetScaler ADC and NetSca
 ler Gateway contain an improper restriction of operations within the bound
 s of a memory buffer vulnerability that could allow for remote code execut
 ion or denial of service\n\nCISA's required action: Apply mitigations in a
 ccordance with vendor instructions\, ensuring compliance with CISA’s BOD
  26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guid
 ance and CISA’s “Forensics Triage Requirements” (see URL in Notes). 
 Follow applicable BOD 26-04 guidance for cloud services or discontinue use
  of the product if mitigations are unavailable. Stakeholders are responsib
 le for evaluating each asset's internet exposure and ensuring adherence to
  BOD 26-04 patching guidelines.\n\nListed by CISA on 2026-09-27. More: htt
 ps://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-88772
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-67279@patchsonar.com
DTSTAMP:20260925T000000Z
DTSTART;VALUE=DATE:20260928
DTEND;VALUE=DATE:20260929
SUMMARY:Patch deadline: MikroTik RouterOS (CVE-2026-67279)
DESCRIPTION:Mikrotik RouterOS Improper Enforcement of Behavioral Workflow V
 ulnerability\n\nMikrotik RouterOS contains an improper enforcement of beha
 vioral workflow vulnerability that could allow an unauthenticated client t
 o open a session channel and send an exec request. This vulnerability can 
 be chained to achieve unauthenticated exploitation of CVE-2026-86060.\n\nC
 ISA's required action: Apply mitigations in accordance with vendor instruc
 tions\, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security 
 Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensic
 s Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 g
 uidance for cloud services or discontinue use of the product if mitigation
 s are unavailable. Stakeholders are responsible for evaluating each asset'
 s internet exposure and ensuring adherence to BOD 26-04 patching guideline
 s.\n\nListed by CISA on 2026-09-25. More: https://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-67279
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-85102@patchsonar.com
DTSTAMP:20260922T000000Z
DTSTART;VALUE=DATE:20260925
DTEND;VALUE=DATE:20260926
SUMMARY:Patch deadline: Check Point Multiple Products (CVE-2026-85102)
DESCRIPTION:Check Point Multiple Products Improper Certificate Validation V
 ulnerability\n\nCheck Point Security Gateway and Check Point Spark Firewal
 l using Site to Site VPN or Remote Access VPN contain an improper certific
 ate validation vulnerability which could allow an unauthenticated remote a
 ttacker to execute arbitrary code on the Gateway.\n\nCISA's required actio
 n: Apply mitigations in accordance with vendor instructions\, ensuring com
 pliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Ris
 k (see URL in Notes) guidance and CISA’s “Forensics Triage Requirement
 s” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud se
 rvices or discontinue use of the product if mitigations are unavailable. S
 takeholders are responsible for evaluating each asset's internet exposure 
 and ensuring adherence to BOD 26-04 patching guidelines.\n\nListed by CISA
  on 2026-09-22. More: https://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-85102
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-93616@patchsonar.com
DTSTAMP:20260922T000000Z
DTSTART;VALUE=DATE:20260925
DTEND;VALUE=DATE:20260926
SUMMARY:Patch deadline: Check Point Multiple Products (CVE-2026-93616)
DESCRIPTION:Check Point Multiple Products Path Traversal Vulnerability\n\nC
 heck Point Security Management Server\, Multi-Domain Security Management S
 erver\, Log Server\, Multi-Domain Log Server\, and SmartEvent contain a pa
 th traversal vulnerability that allows an unauthenticated attacker to uplo
 ad and execute arbitrary scripts.\n\nCISA's required action: Apply mitigat
 ions in accordance with vendor instructions\, ensuring compliance with CIS
 A’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in No
 tes) guidance and CISA’s “Forensics Triage Requirements” (see URL in
  Notes). Follow applicable BOD 26-04 guidance for cloud services or discon
 tinue use of the product if mitigations are unavailable. Stakeholders are 
 responsible for evaluating each asset's internet exposure and ensuring adh
 erence to BOD 26-04 patching guidelines.\n\nListed by CISA on 2026-09-22. 
 More: https://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-93616
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-93952@patchsonar.com
DTSTAMP:20260922T000000Z
DTSTART;VALUE=DATE:20260925
DTEND;VALUE=DATE:20260926
SUMMARY:Patch deadline: Arista VeloCloud Orchestrator (CVE-2026-93952)
DESCRIPTION:Arista VeloCloud Orchestrator Improper Input Validation Vulnera
 bility\n\nArista VeloCloud Orchestrator (VCO) on-prem contains an improper
  input validation vulnerability that may allow a remote attacker to access
  privileged internal functionality and impact the VCO host. Successful exp
 loitation may compromise the confidentiality\, integrity\, and availabilit
 y of the orchestrator and data managed by the orchestrator.\n\nCISA's requ
 ired action: Apply mitigations in accordance with vendor instructions\, en
 suring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Ba
 sed on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage R
 equirements” (see URL in Notes). Follow applicable BOD 26-04 guidance fo
 r cloud services or discontinue use of the product if mitigations are unav
 ailable. Stakeholders are responsible for evaluating each asset's internet
  exposure and ensuring adherence to BOD 26-04 patching guidelines.\n\nList
 ed by CISA on 2026-09-22. More: https://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-93952
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-94127@patchsonar.com
DTSTAMP:20260922T000000Z
DTSTART;VALUE=DATE:20260925
DTEND;VALUE=DATE:20260926
SUMMARY:Patch deadline: F5 BIG-IP APM (CVE-2026-94127)
DESCRIPTION:F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability\n\nF5 BI
 G-IP APM contains a heap-based buffer overflow vulnerability when access p
 olicy and an OAuth profile are configured on a virtual server. This vulner
 ability could allow an unauthenticated attacker to perform remote code exe
 cution.\n\nCISA's required action: Apply mitigations in accordance with ve
 ndor instructions\, ensuring compliance with CISA’s BOD 26-04 Prioritizi
 ng Security Updates Based on Risk (see URL in Notes) guidance and CISA’s
  “Forensics Triage Requirements” (see URL in Notes). Follow applicable
  BOD 26-04 guidance for cloud services or discontinue use of the product i
 f mitigations are unavailable. Stakeholders are responsible for evaluating
  each asset's internet exposure and ensuring adherence to BOD 26-04 patchi
 ng guidelines.\n\nListed by CISA on 2026-09-22. More: https://patchsonar.c
 om/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-94127
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-7273@patchsonar.com
DTSTAMP:20260921T000000Z
DTSTART;VALUE=DATE:20260924
DTEND;VALUE=DATE:20260925
SUMMARY:Patch deadline: Zyxel GS1900 Series Switches (CVE-2026-7273)
DESCRIPTION:Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulner
 ability\n\nZyxel GS1900 series switches contain a stack-based buffer overf
 low vulnerability in the CGI program which could allow a LAN-based\, unaut
 henticated attacker to exploit the flaw and potentially execute OS command
 s via a crafted HTTP request.\n\nCISA's required action: Apply mitigations
  in accordance with vendor instructions\, ensuring compliance with CISA’
 s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes)
  guidance and CISA’s “Forensics Triage Requirements” (see URL in Not
 es). Follow applicable BOD 26-04 guidance for cloud services or discontinu
 e use of the product if mitigations are unavailable. Stakeholders are resp
 onsible for evaluating each asset's internet exposure and ensuring adheren
 ce to BOD 26-04 patching guidelines.\n\nListed by CISA on 2026-09-21. More
 : https://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-7273
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-76460@patchsonar.com
DTSTAMP:20260916T000000Z
DTSTART;VALUE=DATE:20260919
DTEND;VALUE=DATE:20260920
SUMMARY:Patch deadline: Cisco Identity Services Engine (CVE-2026-76460)
DESCRIPTION:Cisco Identity Services Engine Incorrect Use of Privileged APIs
  Vulnerability\n\nCisco Identity Services Engine (ISE) and Cisco ISE Passi
 ve Identity Connector (ISE-PIC) contain an incorrect use of privileged API
 s vulnerability that could allow an unauthenticated\, remote attacker to g
 ain unauthorized access to the affected device by bypassing the web-based 
 management interface.\n\nCISA's required action: Apply mitigations in acco
 rdance with vendor instructions\, ensuring compliance with CISA’s BOD 26
 -04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidanc
 e and CISA’s “Forensics Triage Requirements” (see URL in Notes). Fol
 low applicable BOD 26-04 guidance for cloud services or discontinue use of
  the product if mitigations are unavailable. Stakeholders are responsible 
 for evaluating each asset's internet exposure and ensuring adherence to BO
 D 26-04 patching guidelines.\n\nListed by CISA on 2026-09-16. More: https:
 //patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-76460
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-76461@patchsonar.com
DTSTAMP:20260914T000000Z
DTSTART;VALUE=DATE:20260917
DTEND;VALUE=DATE:20260918
SUMMARY:Patch deadline: Cisco Secure Email Gateway (CVE-2026-76461)
DESCRIPTION:Cisco Secure Email Gateway SQL Injection Vulnerability\n\nCisco
  AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL inje
 ction vulnerability that could allow an unauthenticated\, remote attacker 
 to execute arbitrary commands with root privileges on the underlying opera
 ting system.\n\nCISA's required action: Apply mitigations in accordance wi
 th vendor instructions\, ensuring compliance with CISA’s BOD 26-04 Prior
 itizing Security Updates Based on Risk (see URL in Notes) guidance and CIS
 A’s “Forensics Triage Requirements” (see URL in Notes). Follow appli
 cable BOD 26-04 guidance for cloud services or discontinue use of the prod
 uct if mitigations are unavailable. Stakeholders are responsible for evalu
 ating each asset's internet exposure and ensuring adherence to BOD 26-04 p
 atching guidelines.\n\nListed by CISA on 2026-09-14. More: https://patchso
 nar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-76461
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-67277@patchsonar.com
DTSTAMP:20260910T000000Z
DTSTART;VALUE=DATE:20260913
DTEND;VALUE=DATE:20260914
SUMMARY:Patch deadline: MikroTik RouterOS (CVE-2026-67277)
DESCRIPTION:MikroTik RouterOS Missing Authentication for Critical Function 
 Vulnerability\n\nMikroTik RouterOS contains a missing authentication for c
 ritical function vulnerability which allows kernel memory disclosure and d
 enial of service in the btest service.\n\nCISA's required action: Apply mi
 tigations in accordance with vendor instructions\, ensuring compliance wit
 h CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL 
 in Notes) guidance and CISA’s “Forensics Triage Requirements” (see U
 RL in Notes). Follow applicable BOD 26-04 guidance for cloud services or d
 iscontinue use of the product if mitigations are unavailable. Stakeholders
  are responsible for evaluating each asset's internet exposure and ensurin
 g adherence to BOD 26-04 patching guidelines.\n\nListed by CISA on 2026-09
 -10. More: https://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-67277
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-86060@patchsonar.com
DTSTAMP:20260910T000000Z
DTSTART;VALUE=DATE:20260913
DTEND;VALUE=DATE:20260914
SUMMARY:Patch deadline: MikroTik RouterOS (CVE-2026-86060)
DESCRIPTION:MikroTik RouterOS Improper Neutralization of Argument Delimiter
 s in a Command Vulnerability\n\nMikroTik RouterOS contains an improper neu
 tralization of argument delimiters in a command vulnerability which allows
  an attacker to change the trusted RouterOS policy mask\, leading to privi
 lege escalation.\n\nCISA's required action: Apply mitigations in accordanc
 e with vendor instructions\, ensuring compliance with CISA’s BOD 26-04 P
 rioritizing Security Updates Based on Risk (see URL in Notes) guidance and
  CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow a
 pplicable BOD 26-04 guidance for cloud services or discontinue use of the 
 product if mitigations are unavailable. Stakeholders are responsible for e
 valuating each asset's internet exposure and ensuring adherence to BOD 26-
 04 patching guidelines.\n\nListed by CISA on 2026-09-10. More: https://pat
 chsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-86060
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2025-25249@patchsonar.com
DTSTAMP:20260909T000000Z
DTSTART;VALUE=DATE:20260912
DTEND;VALUE=DATE:20260913
SUMMARY:Patch deadline: Fortinet Multiple Products (CVE-2025-25249)
DESCRIPTION:Fortinet Multiple Products Heap-based Buffer Overflow Vulnerabi
 lity\n\nFortinet FortiOS\, FortiSwitchManager\, and FortiSASE contain a he
 ap-based buffer overflow vulnerability that allows an attacker to execute 
 unauthorized code or commands via specially crafted packets.\n\nCISA's req
 uired action: Apply mitigations in accordance with vendor instructions\, e
 nsuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates B
 ased on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage 
 Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance f
 or cloud services or discontinue use of the product if mitigations are una
 vailable. Stakeholders are responsible for evaluating each asset's interne
 t exposure and ensuring adherence to BOD 26-04 patching guidelines.\n\nLis
 ted by CISA on 2026-09-09. More: https://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2025-25249
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-19490@patchsonar.com
DTSTAMP:20260909T000000Z
DTSTART;VALUE=DATE:20260912
DTEND;VALUE=DATE:20260913
SUMMARY:Patch deadline: Citrix NetScaler (CVE-2026-19490)
DESCRIPTION:Citrix NetScaler Authentication Bypass Using an Alternate Path 
 or Channel Vulnerability\n\nCitrix NetScaler ADC and NetScaler Gateway con
 tain an authentication-bypass vulnerability involving an alternate path or
  channel. When the NetScaler appliance is configured as an AAA virtual ser
 ver or as a Gateway (SSL VPN\, ICA Proxy\, CVPN\, or RDP Proxy)\, an unaut
 henticated remote threat actor may be able to bypass authentication.\n\nCI
 SA's required action: Apply mitigations in accordance with vendor instruct
 ions\, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security U
 pdates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics
  Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 gu
 idance for cloud services or discontinue use of the product if mitigations
  are unavailable. Stakeholders are responsible for evaluating each asset's
  internet exposure and ensuring adherence to BOD 26-04 patching guidelines
 .\n\nListed by CISA on 2026-09-09. More: https://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-19490
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-20079@patchsonar.com
DTSTAMP:20260909T000000Z
DTSTART;VALUE=DATE:20260912
DTEND;VALUE=DATE:20260913
SUMMARY:Patch deadline: Cisco Secure Firewall Management Center (FMC) and S
 ecurity Cloud Control (SCC) Firewall Management (CVE-2026-20079)
DESCRIPTION:Cisco Firewall Management Center Authentication Bypass Using an
  Alternate Path or Channel Vulnerability\n\nCisco Secure Firewall Manageme
 nt Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall M
 anagement contain an authentication Bypass using an alternate path or chan
 nel vulnerability that could allow an unauthenticated\, remote attacker to
  bypass authentication and execute script files on an affected device to o
 btain root access to the underlying operating system.\n\nCISA's required a
 ction: Apply mitigations in accordance with vendor instructions\, ensuring
  compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on
  Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Require
 ments” (see URL in Notes). Follow applicable BOD 26-04 guidance for clou
 d services or discontinue use of the product if mitigations are unavailabl
 e. Stakeholders are responsible for evaluating each asset's internet expos
 ure and ensuring adherence to BOD 26-04 patching guidelines.\n\nListed by 
 CISA on 2026-09-09. More: https://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-20079
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-83548@patchsonar.com
DTSTAMP:20260902T000000Z
DTSTART;VALUE=DATE:20260905
DTEND;VALUE=DATE:20260906
SUMMARY:Patch deadline: SonicWall SMA1000 Appliances (CVE-2026-83548)
DESCRIPTION:SonicWall SMA1000 Appliances Server-Side Request Forgery Vulner
 ability\n\nSonicWall SMA1000 Appliances contains a server-side request for
 gery vulnerability that could allow a remote unauthenticated attacker to g
 ain unauthorized access to sensitive functionality and perform unauthorize
 d operations.\n\nCISA's required action: Apply mitigations in accordance w
 ith vendor instructions\, ensuring compliance with CISA’s BOD 26-04 Prio
 ritizing Security Updates Based on Risk (see URL in Notes) guidance and CI
 SA’s “Forensics Triage Requirements” (see URL in Notes). Follow appl
 icable BOD 26-04 guidance for cloud services or discontinue use of the pro
 duct if mitigations are unavailable. Stakeholders are responsible for eval
 uating each asset's internet exposure and ensuring adherence to BOD 26-04 
 patching guidelines.\n\nListed by CISA on 2026-09-02. More: https://patchs
 onar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-83548
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-83549@patchsonar.com
DTSTAMP:20260902T000000Z
DTSTART;VALUE=DATE:20260905
DTEND;VALUE=DATE:20260906
SUMMARY:Patch deadline: SonicWall SMA1000 Appliances (CVE-2026-83549)
DESCRIPTION:SonicWall SMA1000 Appliances OS Command Injection Vulnerability
 \n\nSonicWall SMA1000 Appliances contains an OS command injection vulnerab
 ility that could enable a remote authenticated attacker as administrator t
 o execute arbitrary OS commands\, resulting in remote code execution.\n\nC
 ISA's required action: Apply mitigations in accordance with vendor instruc
 tions\, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security 
 Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensic
 s Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 g
 uidance for cloud services or discontinue use of the product if mitigation
 s are unavailable. Stakeholders are responsible for evaluating each asset'
 s internet exposure and ensuring adherence to BOD 26-04 patching guideline
 s.\n\nListed by CISA on 2026-09-02. More: https://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-83549
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-8452@patchsonar.com
DTSTAMP:20260826T000000Z
DTSTART;VALUE=DATE:20260829
DTEND;VALUE=DATE:20260830
SUMMARY:Patch deadline: Citrix NetScaler ADC and NetScaler Gateway (CVE-202
 6-8452)
DESCRIPTION:Citrix NetScaler ADC and NetScaler Gateway Improper Restriction
  of Operations within the Bounds of a Memory Buffer Vulnerability\n\nCitri
 x NetScaler ADC and NetScaler Gateway contain an improper restriction of o
 perations within the bounds of a memory buffer vulnerability which could l
 ead to denial of service. \n\nCISA's required action: Apply mitigations in
  accordance with vendor instructions\, ensuring compliance with CISA’s B
 OD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) gu
 idance and CISA’s “Forensics Triage Requirements” (see URL in Notes)
 . Follow applicable BOD 26-04 guidance for cloud services or discontinue u
 se of the product if mitigations are unavailable. Stakeholders are respons
 ible for evaluating each asset's internet exposure and ensuring adherence 
 to BOD 26-04 patching guidelines.\n\nListed by CISA on 2026-08-26. More: h
 ttps://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-8452
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-20349@patchsonar.com
DTSTAMP:20260811T000000Z
DTSTART;VALUE=DATE:20260814
DTEND;VALUE=DATE:20260815
SUMMARY:Patch deadline: Cisco Secure Firewall Adaptive Security Appliance (
 ASA) and Secure Firewall Threat Defense (FTD)  (CVE-2026-20349)
DESCRIPTION:Cisco Secure Firewall Adaptive Security Appliance (ASA) and Sec
 ure Firewall Threat Defense (FTD) Heap Inspection Vulnerability\n\nCisco S
 ecure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threa
 t Defense (FTD) contain a heap inspection vulnerability that could allow a
 n unauthenticated\, remote attacker to cause the device to reload unexpect
 edly\, resulting in a denial of service (DoS) condition.\n\nCISA's require
 d action: Apply mitigations in accordance with vendor instructions\, ensur
 ing compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based
  on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requ
 irements” (see URL in Notes). Follow applicable BOD 26-04 guidance for c
 loud services or discontinue use of the product if mitigations are unavail
 able. Stakeholders are responsible for evaluating each asset's internet ex
 posure and ensuring adherence to BOD 26-04 patching guidelines.\n\nListed 
 by CISA on 2026-08-11. More: https://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-20349
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-8037@patchsonar.com
DTSTAMP:20260807T000000Z
DTSTART;VALUE=DATE:20260810
DTEND;VALUE=DATE:20260811
SUMMARY:Patch deadline: Progress LoadMaster (CVE-2026-8037)
DESCRIPTION:Progress LoadMaster Command Injection Vulnerability\n\nProgress
  LoadMaster contains a command injection vulnerability that allows an un-a
 uthenticated attacker to execute arbitrary commands on the LoadMaster appl
 iance by exploiting unsanitized input in multiple command endpoints.\n\nCI
 SA's required action: Apply mitigations in accordance with vendor instruct
 ions\, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security U
 pdates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics
  Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 gu
 idance for cloud services or discontinue use of the product if mitigations
  are unavailable. Stakeholders are responsible for evaluating each asset's
  internet exposure and ensuring adherence to BOD 26-04 patching guidelines
 .\n\nListed by CISA on 2026-08-07. More: https://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-8037
TRANSP:TRANSPARENT
END:VEVENT
END:VCALENDAR