SQ Magazine The Threat Index Patch Tuesday Dashboard
Patch Tuesday Dashboard
This dashboard records monthly security-update cycles from nine vendors: Microsoft, Adobe, SAP, Siemens, and Schneider Electric on the second Tuesday, plus four security-software vendors in the months they publish CVE advisories for their own products. Each row gives the cycle month, how many vulnerabilities shipped an installable update, how many the vendor rated critical, and how many were reported as exploited at release. Counts are comparable for one vendor over time, never between vendors.
76 records next Patch Tuesday 10 Nov 2026 last verified 21 Oct 2026 next review by 20 Nov 2026
- Cycles tracked
- 76
- Latest Microsoft cycle
- 1,403
- Zero-days in 2026
- 40
- Tracking since
- Jan 2025
Microsoft CVEs per cycle, Jan 2025 to Oct 2026
At a glance
- Most recent cycle
- Siemens Oct 2026
- Most CVEs in one cycle
- Microsoft, Oct 2026 1,403 CVEs
- Most zero-days in one cycle
- Microsoft, Jan 2025 8 exploited at release
All records
76 cycles, newest cycle first. Filter or search below.
How to use this tracker
Search & filter
Filter by vendor or exploitation, or use the search box to find a specific cycle.
Explore the data
Sort by newest first, oldest first or A to Z.
Inspect records
Select Detail on any row to open its full record, then copy a link that opens that row directly.
Verify sources
Every row links the primary source it came from, most often msrc.microsoft.com.
| Vendor | Cycle | CVEs | Critical | Zero-days (exploited at release) | Bulletin | Detail |
|---|---|---|---|---|---|---|
| Siemens | Oct 2026 | 37 | 2 | 1 Exploited | Advisory | |
|
||||||
| Schneider Electric | Oct 2026 | 1 | 0 | 0 | Advisory | |
|
||||||
| SAP | Oct 2026 | 20 | 4 | 0 | Advisory | |
|
||||||
| Kaspersky | Oct 2026 | 3 | Undisclosed | 0 | Advisory | |
|
||||||
| Adobe | Oct 2026 | 177 | Undisclosed | 0 | Advisory | |
|
||||||
| Microsoft | Oct 2026 | 1,403 | 77 | 3 Exploited | Advisory | |
|
||||||
| Siemens | Sep 2026 | 21 | 3 | 0 | Advisory | |
|
||||||
| Schneider Electric | Sep 2026 | 4 | 1 | 0 | Advisory | |
|
||||||
| SAP | Sep 2026 | 18 | 4 | 0 | Advisory | |
|
||||||
| Kaspersky | Sep 2026 | 1 | Undisclosed | 0 | Advisory | |
|
||||||
| ESET | Sep 2026 | 1 | 0 | 0 | Advisory | |
|
||||||
| Adobe | Sep 2026 | 224 | Undisclosed | 1 Exploited | Advisory | |
|
||||||
| Microsoft | Sep 2026 | 940 | 98 | 2 Exploited | Advisory | |
|
||||||
| Schneider Electric | Aug 2026 | 3 | 0 | 0 | Advisory | |
|
||||||
| Siemens | Aug 2026 | 24 | 2 | 0 | Advisory | |
|
||||||
| SAP | Aug 2026 | 35 | 3 | 0 | Advisory | |
|
||||||
| Adobe | Aug 2026 | 100 | Undisclosed | 0 Exploited | Advisory | |
|
||||||
| Microsoft | Aug 2026 | 377 | 44 | 3 Exploited | Advisory | |
|
||||||
| Bitdefender | Jul 2026 | 1 | 0 | 0 | Advisory | |
|
||||||
| ESET | Jul 2026 | 4 | 0 | 0 | Advisory | |
|
||||||
| Schneider Electric | Jul 2026 | 2 | 0 | 0 | Advisory | |
|
||||||
| Siemens | Jul 2026 | 46 | 10 | 0 | Advisory | |
|
||||||
| Adobe | Jul 2026 | 106 | Undisclosed | 0 | Advisory | |
|
||||||
| SAP | Jul 2026 | 16 | 3 | 0 | Advisory | |
|
||||||
| Microsoft | Jul 2026 | 543 | 54 | 4 Exploited | Advisory | |
|
||||||
| Bitdefender | Jun 2026 | 2 | 0 | 0 | Advisory | |
|
||||||
| Schneider Electric | Jun 2026 | 6 | 0 | 0 | Advisory | |
|
||||||
| Siemens | Jun 2026 | 84 | 3 | 0 | Advisory | |
|
||||||
| Adobe | Jun 2026 | 139 | Undisclosed | 1 Exploited | Advisory | |
|
||||||
| SAP | Jun 2026 | 12 | 3 | 0 | Advisory | |
|
||||||
| Microsoft | Jun 2026 | 189 | 30 | 4 | Advisory | |
|
||||||
| Kaspersky | May 2026 | 4 | Undisclosed | 0 | Advisory | |
|
||||||
| Trend Micro | May 2026 | 8 | 0 | 1 Exploited | Advisory | |
|
||||||
| Schneider Electric | May 2026 | 4 | 0 | 0 | Advisory | |
|
||||||
| Siemens | May 2026 | 237 | 27 | 0 | Advisory | |
|
||||||
| Adobe | May 2026 | 51 | Undisclosed | 0 | Advisory | |
|
||||||
| SAP | May 2026 | 16 | 2 | 0 | Advisory | |
|
||||||
| Microsoft | May 2026 | 107 | 16 | 4 Exploited | Advisory | |
|
||||||
| Schneider Electric | Apr 2026 | 7 | 0 | 0 | Advisory | |
|
||||||
| Siemens | Apr 2026 | 22 | 2 | 0 | Advisory | |
|
||||||
| Adobe | Apr 2026 | 53 | Undisclosed | 1 Exploited | Advisory | |
|
||||||
| SAP | Apr 2026 | 17 | 1 | 0 | Advisory | |
|
||||||
| Microsoft | Apr 2026 | 161 | 8 | 3 Exploited | Advisory | |
|
||||||
| Trend Micro | Mar 2026 | 1 | Undisclosed | 0 | Advisory | |
|
||||||
| Kaspersky | Mar 2026 | 2 | Undisclosed | 0 | Advisory | |
|
||||||
| Schneider Electric | Mar 2026 | 6 | 0 | 0 | Advisory | |
|
||||||
| Siemens | Mar 2026 | 39 | 2 | 0 | Advisory | |
|
||||||
| Adobe | Mar 2026 | 81 | Undisclosed | 0 | Advisory | |
|
||||||
| SAP | Mar 2026 | 13 | 1 | 0 | Advisory | |
|
||||||
| Microsoft | Mar 2026 | 62 | 3 | 2 | Advisory | |
|
||||||
| ESET | Feb 2026 | 1 | 0 | 0 | Advisory | |
|
||||||
| Trend Micro | Feb 2026 | 11 | 2 | 0 | Advisory | |
|
||||||
| Schneider Electric | Feb 2026 | 3 | 1 | 0 | Advisory | |
|
||||||
| Siemens | Feb 2026 | 13 | 0 | 0 | Advisory | |
|
||||||
| Adobe | Feb 2026 | 44 | Undisclosed | 0 | Advisory | |
|
||||||
| SAP | Feb 2026 | 27 | 2 | 0 | Advisory | |
|
||||||
| Microsoft | Feb 2026 | 45 | 0 | 6 Exploited | Advisory | |
|
||||||
| ESET | Jan 2026 | 1 | 0 | 0 | Advisory | |
|
||||||
| Trend Micro | Jan 2026 | 8 | 1 | 0 | Advisory | |
|
||||||
| Schneider Electric | Jan 2026 | 7 | 1 | 0 | Advisory | |
|
||||||
| Siemens | Jan 2026 | 71 | 4 | 0 | Advisory | |
|
||||||
| Adobe | Jan 2026 | 25 | Undisclosed | 0 | Advisory | |
|
||||||
| SAP | Jan 2026 | 20 | 4 | 0 | Advisory | |
|
||||||
| Microsoft | Jan 2026 | 111 | 8 | 4 Exploited | Advisory | |
|
||||||
| Microsoft | Dec 2025 | 55 | 2 | 3 Exploited | Advisory | |
|
||||||
| Microsoft | Nov 2025 | 59 | 4 | 1 Exploited | Advisory | |
|
||||||
| Microsoft | Oct 2025 | 161 | 7 | 5 Exploited | Advisory | |
|
||||||
| Microsoft | Sep 2025 | 79 | 8 | 2 | Advisory | |
|
||||||
| Microsoft | Aug 2025 | 98 | 10 | 1 | Advisory | |
|
||||||
| Microsoft | Jul 2025 | 134 | 14 | 2 Exploited | Advisory | |
|
||||||
| Microsoft | Jun 2025 | 63 | 10 | 2 Exploited | Advisory | |
|
||||||
| Microsoft | May 2025 | 66 | 5 | 6 Exploited | Advisory | |
|
||||||
| Microsoft | Apr 2025 | 113 | 11 | 1 Exploited | Advisory | |
|
||||||
| Microsoft | Mar 2025 | 53 | 5 | 7 Exploited | Advisory | |
|
||||||
| Microsoft | Feb 2025 | 50 | 3 | 3 Exploited | Advisory | |
|
||||||
| Microsoft | Jan 2025 | 155 | 10 | 8 Exploited | Advisory | |
|
||||||
No records match the current filters.
About this data
- Scope
- Every bulletin a tracked vendor publishes in its monthly security cycle.
- Key facts
- 76 vendor cycles from 9 vendors, 6,903 CVEs in total, 2025-01 to 2026-10. Counts are comparable for one vendor over time, never between vendors.
- 81 of those were disclosed as exploited before a fix existed.
- This cycle
- This cycle, every row for the eight vendors after Microsoft was recounted to its weekly job, read from each vendor’s own channel: Adobe and SAP from their CVE records, Siemens and Schneider Electric from their CSAF advisories, and the four security-software vendors from their advisory pages. 26 past rows changed and 12 monthly rows were added through October 2026. Adobe’s critical column is now blank, because Adobe rates severity only in its bulletins. Microsoft rows are unchanged, and the ledger lists every change.
- Reading the table
- Monthly vendor patch cycles. Counts are taken from each vendor's own security bulletin, linked per row. Counts can be revised by the vendor after publication. Informational only, not patching guidance for your environment.
Using this data in research or journalism?
Quoting a figure with a link to this page needs no permission. Reuse of the compiled dataset is licensed under CC BY 4.0: credit SQ Magazine and link back.
What the data shows
The charts below redraw the table above as the trends and comparisons a table cannot show.
Critical CVEs by cycle
Vendor-rated criticals per bulletin cycle. An outlined cell is unverified, not zero.
Microsoft severity mix by cycle
Critical, important, and the rest of each bulletin. A missing cycle is unverified, not quiet.
- Critical
- Important
- Other
Zero-days and exploited, per Microsoft cycle
Publicly disclosed zero-days and vulnerabilities Microsoft lists as exploited. Absent bars are unverified.
- Zero-days
- Exploited
Verification ledger
5 most recent of 41 logged updates · RSSLatest Updated (primary source)
October 2026 zero-days 0 to 1
CVEs 1371 to 1403, critical 65 to 77, important 1303 to 1325
CVEs 943 to 940, important 845 to 842
CVEs 382 to 377, important 337 to 332, zero-days 4 to 3, zero-day CVE list
CVEs 545 to 543, important 489 to 487
How this tracker is maintained
Every row passes the same checks before it appears, read from the vendor’s own data on a fixed weekly rhythm.
-
Sourced
Counts come from each vendor’s own security channel, linked on every row: Microsoft’s MSRC guide, the CVE records Adobe and SAP publish for their own products, the Siemens and Schneider Electric CSAF advisories, and each security-software vendor’s advisory pages. Only vulnerabilities with an installable fix count, so Chromium CVEs mirrored into Edge, server-side cloud fixes and flaws still waiting for a fix are excluded.
-
Dated
Each row is one vendor’s calendar month, counted by when each fix was first published. Most fixes ship on the second Tuesday; fixes released between Patch Tuesdays count in the month they shipped, and a month appears only once its Patch Tuesday has passed.
-
Re-checked
Every row is read again from its source each week, well inside the 30-day cycle, so revised counts and new exploitation reports reach the table within days. A row its source no longer supports is held for a person to check, never silently removed.
- Why do these counts differ from news reports?
- Most outlets count every CVE identifier in the bulletin. This tracker counts vulnerabilities that ship an installable update, which is the number an administrator actually patches.
- What counts as critical, and as a zero-day?
- Critical follows the vendor’s own rating where it rates each flaw or advisory (Microsoft and ESET). For the other vendors it is the vendor’s own CVSS score of 9.0 or higher, which for SAP is exactly its Hot News band. Adobe’s critical cells are blank: Adobe labels severity in its bulletins, its CVE records carry only CVSS scores, and no score cut-off reproduces the label. Elsewhere, a blank critical cell means at least one of that month’s flaws carried no vendor score. A zero-day is a flaw the vendor marks as exploited at release (Microsoft also counts flaws publicly disclosed before the fix). Where a vendor publishes no such statement, it is a flaw that CISA’s Known Exploited Vulnerabilities catalog lists under that vendor’s own name by seven days after the fix shipped. Flaws in third-party components a vendor ships, which the catalog lists under their maker, are not counted as that vendor’s zero-days.
- Which vendors are covered?
- Microsoft, Adobe, SAP, Siemens, and Schneider Electric, all of which release on the second Tuesday, plus security-software vendors in months where they publish CVE advisories for their own products. Vendor counts are not comparable to each other: Siemens advisories bundle upstream component CVEs, and Kaspersky’s fixes address third-party components inside its own products. Compare a vendor with itself over time, not with its neighbors.
This is informational content, not patching guidance for your environment. Counts reflect the vendor’s bulletin at release and can be revised. Prioritize using the linked advisory and your own asset inventory.
