BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//Patch Sonar//CISA patch deadlines//EN
CALSCALE:GREGORIAN
METHOD:PUBLISH
X-WR-CALNAME:Patch Sonar deadlines: Office\, email & file sharing
X-WR-CALDESC:Federal fix deadlines for actively exploited vulnerabilities\,
  from CISA's KEV catalog. patchsonar.com
REFRESH-INTERVAL;VALUE=DURATION:PT6H
X-PUBLISHED-TTL:PT6H
BEGIN:VEVENT
UID:CVE-2026-110447@patchsonar.com
DTSTAMP:20261023T000000Z
DTSTART;VALUE=DATE:20261026
DTEND;VALUE=DATE:20261027
SUMMARY:Patch deadline: Collabora Collabora Online – Built-in CODE Server
  (CVE-2026-110447)
DESCRIPTION:Collabora Online – Built-in CODE Server OS Command Injection 
 Vulnerability\n\nCollabora Collabora Online – Built-in CODE Server when 
 used within the NextCloud platform contains an OS command injection vulner
 ability that allows for remote code execution when the CODE server isn't r
 unning.\n\nCISA's required action: Apply mitigations in accordance with ve
 ndor instructions\, ensuring compliance with CISA’s BOD 26-04 Prioritizi
 ng Security Updates Based on Risk (see URL in Notes) guidance and CISA’s
  “Forensics Triage Requirements” (see URL in Notes). Follow applicable
  BOD 26-04 guidance for cloud services or discontinue use of the product i
 f mitigations are unavailable. Stakeholders are responsible for evaluating
  each asset's internet exposure and ensuring adherence to BOD 26-04 patchi
 ng guidelines.\n\nListed by CISA on 2026-10-23. More: https://patchsonar.c
 om/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-110447
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2015-3306@patchsonar.com
DTSTAMP:20261008T000000Z
DTSTART;VALUE=DATE:20261011
DTEND;VALUE=DATE:20261012
SUMMARY:Patch deadline: ProFTPD ProFTPD (CVE-2015-3306)
DESCRIPTION:ProFTPD Improper Access Control Vulnerability\n\nProFTPD contai
 ns an improper access control vulnerability that could allow remote attack
 ers to read and write to arbitrary files via the site cpfr and site cpto c
 ommands.\n\nCISA's required action: Apply mitigations in accordance with v
 endor instructions\, ensuring compliance with CISA’s BOD 26-04 Prioritiz
 ing Security Updates Based on Risk (see URL in Notes) guidance and CISA’
 s “Forensics Triage Requirements” (see URL in Notes). Follow applicabl
 e BOD 26-04 guidance for cloud services or discontinue use of the product 
 if mitigations are unavailable. Stakeholders are responsible for evaluatin
 g each asset's internet exposure and ensuring adherence to BOD 26-04 patch
 ing guidelines.\n\nListed by CISA on 2026-10-08. More: https://patchsonar.
 com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2015-3306
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2021-3199@patchsonar.com
DTSTAMP:20261008T000000Z
DTSTART;VALUE=DATE:20261011
DTEND;VALUE=DATE:20261012
SUMMARY:Patch deadline: ONLYOFFICE Docs (CVE-2021-3199)
DESCRIPTION:ONLYOFFICE Docs Server Path Traversal Vulnerability\n\nONLYOFFI
 CE Docs contains a path traversal vulnerability that can occur when JWT is
  used\, via a /.. sequence in an image upload parameter and could allow fo
 r remote code execution.\n\nCISA's required action: Apply mitigations in a
 ccordance with vendor instructions\, ensuring compliance with CISA’s BOD
  26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guid
 ance and CISA’s “Forensics Triage Requirements” (see URL in Notes). 
 Follow applicable BOD 26-04 guidance for cloud services or discontinue use
  of the product if mitigations are unavailable. Stakeholders are responsib
 le for evaluating each asset's internet exposure and ensuring adherence to
  BOD 26-04 patching guidelines.\n\nListed by CISA on 2026-10-08. More: htt
 ps://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2021-3199
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-65660@patchsonar.com
DTSTAMP:20260925T000000Z
DTSTART;VALUE=DATE:20260928
DTEND;VALUE=DATE:20260929
SUMMARY:Patch deadline: Microsoft SharePoint (CVE-2026-65660)
DESCRIPTION:Microsoft SharePoint Code Injection Vulnerability\n\nMicrosoft 
 SharePoint contains a code injection vulnerability which could allow an au
 thorized attacker to execute code over a network.\n\nCISA's required actio
 n: Apply mitigations in accordance with vendor instructions\, ensuring com
 pliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Ris
 k (see URL in Notes) guidance and CISA’s “Forensics Triage Requirement
 s” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud se
 rvices or discontinue use of the product if mitigations are unavailable. S
 takeholders are responsible for evaluating each asset's internet exposure 
 and ensuring adherence to BOD 26-04 patching guidelines.\n\nListed by CISA
  on 2026-09-25. More: https://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-65660
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2023-49105@patchsonar.com
DTSTAMP:20260827T000000Z
DTSTART;VALUE=DATE:20260830
DTEND;VALUE=DATE:20260831
SUMMARY:Patch deadline: ownCloud ownCloud (CVE-2023-49105)
DESCRIPTION:ownCloud Improper Authentication Vulnerability\n\nownCloud cont
 ains an improper authentication vulnerability that allows an attacker to a
 ccess\, modify\, or delete any file without authentication if the username
  of a victim is known\, and the victim has no signing-key configured.\n\nC
 ISA's required action: Apply mitigations in accordance with vendor instruc
 tions\, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security 
 Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensic
 s Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 g
 uidance for cloud services or discontinue use of the product if mitigation
 s are unavailable. Stakeholders are responsible for evaluating each asset'
 s internet exposure and ensuring adherence to BOD 26-04 patching guideline
 s.\n\nListed by CISA on 2026-08-27. More: https://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2023-49105
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-73570@patchsonar.com
DTSTAMP:20260821T000000Z
DTSTART;VALUE=DATE:20260824
DTEND;VALUE=DATE:20260825
SUMMARY:Patch deadline: Synacor Zimbra Collaboration Suite (ZCS) (CVE-2026-
 73570)
DESCRIPTION:Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerabi
 lity\n\nZimbra Collaboration Suite (ZCS) contains an OS command injection 
 vulnerability which could allow an unauthenticated attacker to send specia
 lly crafted SMTP requests that may result in execution of arbitrary operat
 ing system commands as the Zimbra user.\n\nCISA's required action: Apply m
 itigations in accordance with vendor instructions\, ensuring compliance wi
 th CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL
  in Notes) guidance and CISA’s “Forensics Triage Requirements” (see 
 URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or 
 discontinue use of the product if mitigations are unavailable. Stakeholder
 s are responsible for evaluating each asset's internet exposure and ensuri
 ng adherence to BOD 26-04 patching guidelines.\n\nListed by CISA on 2026-0
 8-21. More: https://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-73570
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-72529@patchsonar.com
DTSTAMP:20260820T000000Z
DTSTART;VALUE=DATE:20260823
DTEND;VALUE=DATE:20260824
SUMMARY:Patch deadline: TrueConf Server (CVE-2026-72529)
DESCRIPTION:TrueConf Server Missing Authentication for Critical Function Vu
 lnerability\n\nTrueConf Server contains a missing authentication for criti
 cal function vulnerability which could allow a remote unauthorized attacke
 r with network access via port 4307/TCP to execute an arbitrary script.\n\
 nCISA's required action: Apply mitigations in accordance with vendor instr
 uctions\, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securit
 y Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forens
 ics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04
  guidance for cloud services or discontinue use of the product if mitigati
 ons are unavailable. Stakeholders are responsible for evaluating each asse
 t's internet exposure and ensuring adherence to BOD 26-04 patching guideli
 nes.\n\nListed by CISA on 2026-08-20. More: https://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-72529
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-72530@patchsonar.com
DTSTAMP:20260820T000000Z
DTSTART;VALUE=DATE:20260903
DTEND;VALUE=DATE:20260904
SUMMARY:Patch deadline: TrueConf Server (CVE-2026-72530)
DESCRIPTION:TrueConf Server Code Injection Vulnerability\n\nTrueConf Server
  contains a code injection vulnerability that could allow an unauthorized 
 remote attacker with network access via port 4307/TCP to use a specially c
 rafted script to break out of the isolated environment and execute arbitra
 ry code on the host system.\n\nCISA's required action: Apply mitigations i
 n accordance with vendor instructions\, ensuring compliance with CISA’s 
 BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) g
 uidance and CISA’s “Forensics Triage Requirements” (see URL in Notes
 ). Follow applicable BOD 26-04 guidance for cloud services or discontinue 
 use of the product if mitigations are unavailable. Stakeholders are respon
 sible for evaluating each asset's internet exposure and ensuring adherence
  to BOD 26-04 patching guidelines.\n\nListed by CISA on 2026-08-20. More: 
 https://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-72530
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-55040@patchsonar.com
DTSTAMP:20260818T000000Z
DTSTART;VALUE=DATE:20260821
DTEND;VALUE=DATE:20260822
SUMMARY:Patch deadline: Microsoft SharePoint (CVE-2026-55040)
DESCRIPTION:Microsoft SharePoint Weak Authentication Vulnerability\n\nMicro
 soft SharePoint contains a weak authentication vulnerability which allows 
 an unauthorized attacker to bypass a security feature over a network.\n\nC
 ISA's required action: Apply mitigations in accordance with vendor instruc
 tions\, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security 
 Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensic
 s Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 g
 uidance for cloud services or discontinue use of the product if mitigation
 s are unavailable. Stakeholders are responsible for evaluating each asset'
 s internet exposure and ensuring adherence to BOD 26-04 patching guideline
 s.\n\nListed by CISA on 2026-08-18. More: https://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-55040
TRANSP:TRANSPARENT
END:VEVENT
END:VCALENDAR