BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//Patch Sonar//CISA patch deadlines//EN
CALSCALE:GREGORIAN
METHOD:PUBLISH
X-WR-CALNAME:Patch Sonar deadlines: Websites & online stores
X-WR-CALDESC:Federal fix deadlines for actively exploited vulnerabilities\,
  from CISA's KEV catalog. patchsonar.com
REFRESH-INTERVAL;VALUE=DURATION:PT6H
X-PUBLISHED-TTL:PT6H
BEGIN:VEVENT
UID:CVE-2026-48356@patchsonar.com
DTSTAMP:20261027T000000Z
DTSTART;VALUE=DATE:20261110
DTEND;VALUE=DATE:20261111
SUMMARY:Patch deadline: Adobe Commerce and Magento (CVE-2026-48356)
DESCRIPTION:Adobe Commerce and Magento Unrestricted Upload of File with Dan
 gerous Type Vulnerability\n\nAdobe Commerce and Magento contain an unrestr
 icted upload of file with dangerous type vulnerability that could result i
 n arbitrary code execution in the context of the current user\, potentiall
 y gaining elevated access or control over the victim's account or session.
 \n\nCISA's required action: Apply mitigations in accordance with vendor in
 structions\, ensuring compliance with CISA’s BOD 26-04 Prioritizing Secu
 rity Updates Based on Risk (see URL in Notes) guidance and CISA’s “For
 ensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26
 -04 guidance for cloud services or discontinue use of the product if mitig
 ations are unavailable. Stakeholders are responsible for evaluating each a
 sset's internet exposure and ensuring adherence to BOD 26-04 patching guid
 elines.\n\nListed by CISA on 2026-10-27. More: https://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-48356
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-109618@patchsonar.com
DTSTAMP:20261026T000000Z
DTSTART;VALUE=DATE:20261029
DTEND;VALUE=DATE:20261030
SUMMARY:Patch deadline: PHP Group PHP (CVE-2026-109618)
DESCRIPTION:PHP Memory Corruption Vulnerability\n\nPHP contains an out-of-m
 emory corruption vulnerability that allows for unauthenticated remote code
  execution.\n\nCISA's required action: Apply mitigations in accordance wit
 h vendor instructions\, ensuring compliance with CISA’s BOD 26-04 Priori
 tizing Security Updates Based on Risk (see URL in Notes) guidance and CISA
 ’s “Forensics Triage Requirements” (see URL in Notes). Follow applic
 able BOD 26-04 guidance for cloud services or discontinue use of the produ
 ct if mitigations are unavailable. Stakeholders are responsible for evalua
 ting each asset's internet exposure and ensuring adherence to BOD 26-04 pa
 tching guidelines.\n\nListed by CISA on 2026-10-26. More: https://patchson
 ar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-109618
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-109619@patchsonar.com
DTSTAMP:20261026T000000Z
DTSTART;VALUE=DATE:20261029
DTEND;VALUE=DATE:20261030
SUMMARY:Patch deadline: PHP Group PHP (CVE-2026-109619)
DESCRIPTION:PHP Stale Internal Request-State Vulnerability\n\nPHP contains 
 a stale internal request-state vulnerability that allows for unauthenticat
 ed remote code execution.\n\nCISA's required action: Apply mitigations in 
 accordance with vendor instructions\, ensuring compliance with CISA’s BO
 D 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) gui
 dance and CISA’s “Forensics Triage Requirements” (see URL in Notes).
  Follow applicable BOD 26-04 guidance for cloud services or discontinue us
 e of the product if mitigations are unavailable. Stakeholders are responsi
 ble for evaluating each asset's internet exposure and ensuring adherence t
 o BOD 26-04 patching guidelines.\n\nListed by CISA on 2026-10-26. More: ht
 tps://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-109619
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-87902@patchsonar.com
DTSTAMP:20260925T000000Z
DTSTART;VALUE=DATE:20260928
DTEND;VALUE=DATE:20260929
SUMMARY:Patch deadline: WordPress Core (CVE-2026-87902)
DESCRIPTION:WordPress Core Remote File Inclusion Vulnerability\n\nWordPress
  Core contains a remote file inclusion vulnerability which could allow an 
 unauthenticated attacker to make page-template resolution include a chosen
  readable local `.php` file outside the active theme directories\, leading
  to remote code execution.\n\nCISA's required action: Apply mitigations in
  accordance with vendor instructions\, ensuring compliance with CISA’s B
 OD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) gu
 idance and CISA’s “Forensics Triage Requirements” (see URL in Notes)
 . Follow applicable BOD 26-04 guidance for cloud services or discontinue u
 se of the product if mitigations are unavailable. Stakeholders are respons
 ible for evaluating each asset's internet exposure and ensuring adherence 
 to BOD 26-04 patching guidelines.\n\nListed by CISA on 2026-09-25. More: h
 ttps://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-87902
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-71362@patchsonar.com
DTSTAMP:20260924T000000Z
DTSTART;VALUE=DATE:20260927
DTEND;VALUE=DATE:20260928
SUMMARY:Patch deadline: Adobe Commerce and Magento  (CVE-2026-71362)
DESCRIPTION:Adobe Commerce and Magento Incorrect Authorization Vulnerabilit
 y \n\nAdobe Commerce and Magento contains an incorrect authorization vulne
 rability that could allow an attacker to leverage this vulnerability to ga
 in elevated access to sensitive resources without any user interaction. \n
 \nCISA's required action: Apply mitigations in accordance with vendor inst
 ructions\, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securi
 ty Updates Based on Risk (see URL in Notes) guidance and CISA’s “Foren
 sics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-0
 4 guidance for cloud services or discontinue use of the product if mitigat
 ions are unavailable. Stakeholders are responsible for evaluating each ass
 et's internet exposure and ensuring adherence to BOD 26-04 patching guidel
 ines.\n\nListed by CISA on 2026-09-24. More: https://patchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-71362
TRANSP:TRANSPARENT
END:VEVENT
BEGIN:VEVENT
UID:CVE-2026-75650@patchsonar.com
DTSTAMP:20260908T000000Z
DTSTART;VALUE=DATE:20260911
DTEND;VALUE=DATE:20260912
SUMMARY:Patch deadline: Adobe Commerce and Magento (CVE-2026-75650)
DESCRIPTION:Adobe Commerce and Magento Improper Neutralization of Special E
 lements Used in a Template Engine Vulnerability\n\nAdobe Commerce and Mage
 nto Open Source contain an improper neutralization of special elements use
 d in a template engine vulnerability that could allow an attacker to execu
 te arbitrary code.\n\nCISA's required action: Apply mitigations in accorda
 nce with vendor instructions\, ensuring compliance with CISA’s BOD 26-04
  Prioritizing Security Updates Based on Risk (see URL in Notes) guidance a
 nd CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow
  applicable BOD 26-04 guidance for cloud services or discontinue use of th
 e product if mitigations are unavailable. Stakeholders are responsible for
  evaluating each asset's internet exposure and ensuring adherence to BOD 2
 6-04 patching guidelines.\n\nListed by CISA on 2026-09-08. More: https://p
 atchsonar.com/
URL:https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api
 _fulltext=CVE-2026-75650
TRANSP:TRANSPARENT
END:VEVENT
END:VCALENDAR