SQ Magazine The Threat Index Patch Tuesday Dashboard
Patch Tuesday Dashboard
This dashboard records monthly security-update cycles from nine vendors: Microsoft, Adobe, SAP, Siemens, and Schneider Electric on the second Tuesday, plus four security-software vendors in the months they publish CVE advisories for their own products. Each row gives the cycle month, how many vulnerabilities shipped an installable update, how many the vendor rated critical, and how many were reported as exploited at release. Counts are comparable for one vendor over time, never between vendors.
62 records next Patch Tuesday 13 Oct 2026 last verified 7 Oct 2026 next review by 6 Nov 2026
- Cycles tracked
- 62
- Latest Microsoft cycle
- 943
- Zero-days in 2026
- 36
- Tracking since
- Jan 2025
Microsoft CVEs per cycle, Jan 2025 to Sep 2026
At a glance
- Most recent cycle
- Microsoft Sep 2026
- Most CVEs in one cycle
- Microsoft, Sep 2026 943 CVEs
- Most zero-days in one cycle
- Microsoft, Jan 2025 8 exploited at release
All records
62 cycles, newest cycle first. Filter or search below.
How to use this tracker
Search & filter
Filter by vendor or exploitation, or use the search box to find a specific cycle.
Explore the data
Sort by newest first, oldest first or A to Z.
Inspect records
Select Detail on any row to open its full record, then copy a link that opens that row directly.
Verify sources
Every row links the primary source it came from, most often msrc.microsoft.com.
| Vendor | Cycle | CVEs | Critical | Zero-days (exploited at release) | Bulletin | Detail |
|---|---|---|---|---|---|---|
| Microsoft | Sep 2026 | 943 | 98 | 2 Exploited | Advisory | |
|
||||||
| Siemens | Aug 2026 | 20 | 2 | 0 | Advisory | |
|
||||||
| SAP | Aug 2026 | 28 | 4 | 0 | Advisory | |
|
||||||
| Adobe | Aug 2026 | 51 | 33 | 0 Exploited | Advisory | |
|
||||||
| Microsoft | Aug 2026 | 382 | 44 | 4 Exploited | Advisory | |
|
||||||
| Bitdefender | Jul 2026 | 1 | Undisclosed | 0 | Advisory | |
|
||||||
| ESET | Jul 2026 | 4 | 0 | 0 | Advisory | |
|
||||||
| Schneider Electric | Jul 2026 | 2 | 0 | 0 | Advisory | |
|
||||||
| Siemens | Jul 2026 | 383 | 19 | 0 | Advisory | |
|
||||||
| Adobe | Jul 2026 | 98 | 72 | 0 | Advisory | |
|
||||||
| SAP | Jul 2026 | 20 | 3 | 0 | Advisory | |
|
||||||
| Microsoft | Jul 2026 | 545 | 54 | 4 Exploited | Advisory | |
|
||||||
| Bitdefender | Jun 2026 | 2 | Undisclosed | 0 | Advisory | |
|
||||||
| Schneider Electric | Jun 2026 | 6 | 0 | 0 | Advisory | |
|
||||||
| Siemens | Jun 2026 | 7 | 1 | 0 | Advisory | |
|
||||||
| Adobe | Jun 2026 | 145 | 64 | 1 Exploited | Advisory | |
|
||||||
| SAP | Jun 2026 | 17 | 4 | 0 | Advisory | |
|
||||||
| Microsoft | Jun 2026 | 189 | 30 | 4 | Advisory | |
|
||||||
| Kaspersky | May 2026 | 4 | Undisclosed | 0 | Advisory | |
|
||||||
| Trend Micro | May 2026 | 8 | 0 | 1 Exploited | Advisory | |
|
||||||
| Schneider Electric | May 2026 | 4 | 0 | 0 | Advisory | |
|
||||||
| Siemens | May 2026 | 236 | 27 | 0 | Advisory | |
|
||||||
| Adobe | May 2026 | 51 | 26 | 0 | Advisory | |
|
||||||
| SAP | May 2026 | 16 | 2 | 0 | Advisory | |
|
||||||
| Microsoft | May 2026 | 107 | 16 | 4 Exploited | Advisory | |
|
||||||
| Schneider Electric | Apr 2026 | 9 | 1 | 0 | Advisory | |
|
||||||
| Siemens | Apr 2026 | 22 | 2 | 0 | Advisory | |
|
||||||
| Adobe | Apr 2026 | 55 | 37 | 1 Exploited | Advisory | |
|
||||||
| SAP | Apr 2026 | 19 | 1 | 0 | Advisory | |
|
||||||
| Microsoft | Apr 2026 | 161 | 8 | 3 Exploited | Advisory | |
|
||||||
| Kaspersky | Mar 2026 | 2 | Undisclosed | 0 | Advisory | |
|
||||||
| Schneider Electric | Mar 2026 | 6 | 0 | 0 | Advisory | |
|
||||||
| Siemens | Mar 2026 | 37 | 2 | 0 | Advisory | |
|
||||||
| Adobe | Mar 2026 | 81 | 22 | 0 | Advisory | |
|
||||||
| SAP | Mar 2026 | 16 | 2 | 0 | Advisory | |
|
||||||
| Microsoft | Mar 2026 | 62 | 3 | 2 | Advisory | |
|
||||||
| ESET | Feb 2026 | 1 | 0 | 0 | Advisory | |
|
||||||
| Trend Micro | Feb 2026 | 8 | 2 | 0 | Advisory | |
|
||||||
| Schneider Electric | Feb 2026 | 3 | 1 | 0 | Advisory | |
|
||||||
| Siemens | Feb 2026 | 13 | 0 | 0 | Advisory | |
|
||||||
| Adobe | Feb 2026 | 44 | 27 | 0 | Advisory | |
|
||||||
| SAP | Feb 2026 | 28 | 2 | 0 | Advisory | |
|
||||||
| Microsoft | Feb 2026 | 45 | 0 | 6 Exploited | Advisory | |
|
||||||
| ESET | Jan 2026 | 1 | 0 | 0 | Advisory | |
|
||||||
| Trend Micro | Jan 2026 | 8 | 1 | 0 | Advisory | |
|
||||||
| Schneider Electric | Jan 2026 | 12 | 1 | 0 | Advisory | |
|
||||||
| Siemens | Jan 2026 | 15 | 1 | 0 | Advisory | |
|
||||||
| Adobe | Jan 2026 | 25 | 18 | 0 | Advisory | |
|
||||||
| SAP | Jan 2026 | 20 | 4 | 0 | Advisory | |
|
||||||
| Microsoft | Jan 2026 | 111 | 8 | 4 Exploited | Advisory | |
|
||||||
| Microsoft | Dec 2025 | 55 | 2 | 3 Exploited | Advisory | |
|
||||||
| Microsoft | Nov 2025 | 59 | 4 | 1 Exploited | Advisory | |
|
||||||
| Microsoft | Oct 2025 | 161 | 7 | 5 Exploited | Advisory | |
|
||||||
| Microsoft | Sep 2025 | 79 | 8 | 2 | Advisory | |
|
||||||
| Microsoft | Aug 2025 | 98 | 10 | 1 | Advisory | |
|
||||||
| Microsoft | Jul 2025 | 134 | 14 | 2 Exploited | Advisory | |
|
||||||
| Microsoft | Jun 2025 | 63 | 10 | 2 Exploited | Advisory | |
|
||||||
| Microsoft | May 2025 | 66 | 5 | 6 Exploited | Advisory | |
|
||||||
| Microsoft | Apr 2025 | 113 | 11 | 1 Exploited | Advisory | |
|
||||||
| Microsoft | Mar 2025 | 53 | 5 | 7 Exploited | Advisory | |
|
||||||
| Microsoft | Feb 2025 | 50 | 3 | 3 Exploited | Advisory | |
|
||||||
| Microsoft | Jan 2025 | 155 | 10 | 8 Exploited | Advisory | |
|
||||||
No records match the current filters.
About this data
- Scope
- Every bulletin a tracked vendor publishes in its monthly security cycle.
- Key facts
- 62 vendor cycles from 9 vendors, 5,159 CVEs in total, 2025-01 to 2026-09. Counts are comparable for one vendor over time, never between vendors.
- 77 of those were disclosed as exploited before a fix existed.
- This cycle
- Nine monthly records were corrected. Twenty-two CVEs with identifiers from 2007 to 2025, among them CVE-2008-4250 under May 2026, had been listed as zero-days for months that did not patch them, most because CISA added them to its Known Exploited Vulnerabilities catalog in that month. Microsoft's own release data confirms none of the 20 Microsoft entries shipped in the month it was listed under. August 2025 for Microsoft and May 2026 for Adobe now show no zero-days. Twenty records point back to the vendor advisory rather than the CISA catalog, and August 2026 records for Microsoft, Adobe, SAP and Siemens were added.
- Reading the table
- Monthly vendor patch cycles. Counts are taken from each vendor's own security bulletin, linked per row. Counts can be revised by the vendor after publication. Informational only, not patching guidance for your environment.
Using this data in research or journalism?
Quoting a figure with a link to this page needs no permission. Reuse of the compiled dataset is licensed under CC BY 4.0: credit SQ Magazine and link back.
What the data shows
The charts below redraw the table above as the trends and comparisons a table cannot show.
Critical CVEs by cycle
Vendor-rated criticals per bulletin cycle. An outlined cell is unverified, not zero.
Microsoft severity mix by cycle
Critical, important, and the rest of each bulletin. A missing cycle is unverified, not quiet.
- Critical
- Important
- Other
Zero-days and exploited, per Microsoft cycle
Publicly disclosed zero-days and vulnerabilities Microsoft lists as exploited. Absent bars are unverified.
- Zero-days
- Exploited
Verification ledger
5 most recent of 27 logged updates · RSSLatest Added (primary source)
New cycle: 943 CVEs, 98 critical, 2 zero-days
CVEs 345 to 382, critical 36 to 44, important 308 to 337
CVEs 530 to 545, critical 52 to 54, important 476 to 489
CVEs 171 to 189, critical 28 to 30, important 143 to 159
CVEs 95 to 107, critical 15 to 16, important 80 to 90
How this tracker is maintained
Every cycle passes the same checks before it appears, on the vendor’s own schedule.
-
Sourced
Counts come from each vendor’s own security channel, linked on every row: Microsoft’s MSRC guide, Adobe’s APSB bulletins, SAP’s Security Patch Day notes, and the Siemens and Schneider Electric CSAF advisories. Chromium CVEs mirrored into Edge and server-side cloud fixes are excluded, because an administrator never installs them.
-
Dated
Each row is one vendor cycle, dated by its Patch Tuesday. The header names the next one.
-
Re-checked
Each cycle is re-checked after release; exploited-at-release flags and revised counts follow the vendor’s bulletin updates.
- Why do these counts differ from news reports?
- Most outlets count every CVE identifier in the bulletin. This tracker counts vulnerabilities that ship an installable update, which is the number an administrator actually patches.
- Which vendors are covered?
- Microsoft, Adobe, SAP, Siemens, and Schneider Electric, all of which release on the second Tuesday, plus security-software vendors in months where they publish CVE advisories for their own products. Vendor counts are not comparable to each other: Siemens advisories bundle upstream component CVEs, Kaspersky’s fixes address third-party components inside its own products, and SAP’s critical tier is its former HotNews band. Compare a vendor with itself over time, not with its neighbors.
This is informational content, not patching guidance for your environment. Counts reflect the vendor’s bulletin at release and can be revised. Prioritize using the linked advisory and your own asset inventory.
