Attribution: CVEs the vendor issues as CNA that were published on the patch day (± 2 days). Microsoft: figures straight from Microsoft (MSRC). Complete data since 1 Oct 2026; older patch days are fetched once, missing ones are shown as “no data”.
Second Tuesday of every month, around 10:00 Pacific Time
Patch Tuesday. Some products do not follow the schedule; urgent updates are released out of band.
Source: Microsoft Learn – Windows release cycle
Next dates: 10 Nov 2026, 8 Dec 2026, 12 Jan 2027
1,475 CVEs94 critical1 exploited (zero-day)CVSS ≤ 10.0
Second Tuesday of every month; Fourth Tuesday of every month (since 14 Jul 2026)
Twice a month (2nd and 4th Tuesday) since 14 Jul 2026, before that only on the 2nd Tuesday. Actively exploited issues also out of band.
Source: Adobe Blog, 25.06.2026
Next dates: 10 Nov 2026, 24 Nov 2026, 8 Dec 2026
0 CVEs
Second Tuesday of every month
SAP Security Patch Day.
Source: SAP Security Patch Day
Next dates: 10 Nov 2026, 8 Dec 2026, 12 Jan 2027
0 CVEs
Critical Patch Update: Third Tuesday of January, April, July and October; Critical Security Patch Update: Third Tuesday of February, March, May, June, August, September, November and December (since 1 Jun 2026)
Quarterly Critical Patch Update (CPU); since May 2026 a Critical Security Patch Update (CSPU) in the other months (the first on 28 May 2026). Security Alerts are unscheduled.
Source: Oracle Critical Patch Updates, Security Alerts and Bulletins
Next dates: 17 Nov 2026, 15 Dec 2026, 19 Jan 2027
0 CVEs
Second Tuesday of every month
Siemens ProductCERT; out-of-band publications only in uncommon circumstances.
Source: Siemens ProductCERT – Advisory Day
Next dates: 10 Nov 2026, 8 Dec 2026, 12 Jan 2027
0 CVEs
Second Tuesday of every month
Source: Schneider Electric – Report a vulnerability
Next dates: 10 Nov 2026, 8 Dec 2026, 12 Jan 2027
0 CVEs
Second Tuesday of every month
Regularly on Patch Tuesday; out-of-cycle fixes do occur.
Source: Ivanti Blog – December Security Update
Next dates: 10 Nov 2026, 8 Dec 2026, 12 Jan 2027
0 CVEs
Second Tuesday of every month
Critical vulnerabilities may be published out of cycle.
Next dates: 10 Nov 2026, 8 Dec 2026, 12 Jan 2027
0 CVEs
Second Wednesday of every month, around 09:00 Pacific Time
Critical issues with active exploitation are published out of cycle.
Source: Palo Alto Networks – Product Security Assurance
Next dates: 11 Nov 2026, 9 Dec 2026, 13 Jan 2027
0 CVEs
Second Wednesday of January, April, July and October
Quarterly for all products; urgent cases out of cycle.
Source: Juniper SIRT – Advisories
Next dates: 13 Jan 2027, 14 Apr 2027, 14 Jul 2027
0 CVEs
IOS and IOS XE: Fourth Wednesday of March and September; IOS XR: Second Wednesday of March and September; FXOS and NX-OS: Fourth Wednesday of February and August, around 16:00 UTC
Semiannual bundled publications; other advisories on any Wednesday, urgent ones at any time.
Source: Cisco Security Vulnerability Policy
Next dates: 24 Feb 2027, 10 Mar 2027, 24 Mar 2027
0 CVEs
Third Tuesday of every month except December
Security bulletins for Data Center and Server; earlier in December (date open), critical advisories out of cycle.
Source: Atlassian Security Bulletins
Next dates: 17 Nov 2026, 19 Jan 2027, 16 Feb 2027
0 CVEs
Second Tuesday of every month
“When possible” on Patch Tuesday; zero-days (e.g. NetScaler) often out of band.
Source: Cloud Software Group – Vulnerability Process
Next dates: 10 Nov 2026, 8 Dec 2026, 12 Jan 2027
0 CVEs
First Monday of every month
If the Monday is a holiday, on the next working day. Device manufacturers ship updates later.
Source: Android Security Bulletins
Next dates: 2 Nov 2026, 7 Dec 2026, 4 Jan 2027
0 CVEs
New milestone every 2 weeks (since Chrome 153 on 8 Sep 2026), weekly security refreshes in between
Dates from the official schedule (chromiumdash); emergency updates for zero-days on any day.
Source: Chrome for Developers – two-week release cycle
Next dates: 3 Nov 2026, 17 Nov 2026, 8 Dec 2026
0 CVEs
New major release every 2 weeks on Tuesday (since Firefox 155 on 1 Sep 2026, every 4 weeks before)
Dates from the official calendar (whattrainisitnow.com); dot releases when needed.
Source: Mozilla – new release cadence
Next dates: 10 Nov 2026, 24 Nov 2026, 8 Dec 2026
0 CVEs
No fixed schedule
Apple releases updates without a fixed schedule and discloses issues only once updates are available.
Source: Apple security releases
0 CVEs
No fixed schedule
Security advisories (VMSA) without a fixed schedule.
Source: Broadcom – VMware Security Advisories
0 CVEs
The tracker combines official, freely usable data sources – updated continuously:
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.
