Zero-Day: upcoming dates

Recent

• Cybersecurity09/23/2026@CyberDesk

  Microsoft's September 2026 Patch Tuesday Fixes a Record 966 Flaws

  One Microsoft Way, Redmond, United StatesMicrosoft

  

  Starts 09/08/2026 5:00PM UTCCONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins87% CONFIDENCEOverall confidence: 87%How well the pin's source and references back up its dates.Weighted average of how firmly 6 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or better24 days agoStated as firm, per bleepingcomputer.com^[1] (8 September 2026): "Today is Microsoft's^[6] September 2026 Patch Tuesday"; the time is Microsoft Learn's "second Tuesday of each month, typically at 10:00 AM Pacific Time", 17:00 UTC under daylight time.

  Microsoft's largest security update ever patches 966 vulnerabilities, including two Windows privilege-escalation zero-days already exploited in attacks and 105 rated Critical.

  00
• Cybersecurity09/24/2026@CyberDesk

  Oracle Issues Emergency Fix for PeopleSoft Zero-Day Hit by ShinyHunters

  2300, Oracle Way, Lakeshore, Austin, Travis County, Texas, 78741, United StatesOracle

  

  Starts 06/10/2026CONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins88% CONFIDENCEOverall confidence: 88%How well the pin's source and references back up its dates.Weighted average of how firmly 4 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or better114 days agoOracle's^[1] Security Alert Advisory CVE-2026-35273 lists '2026-June-10 Rev 1. Initial Release' in its modification history.

  Oracle's Security Alert for CVE-2026-35273, a 9.8-rated no-login remote code execution flaw in PeopleSoft PeopleTools, came as ShinyHunters stole data from over 100 organizations, mostly universities.

  00
• Cybersecurity09/25/2026@CyberDesk

  Qualcomm Discloses Exploited Graphics Flaw CVE-2026-21385

  Qualcomm N, 5775, Morehouse Drive, Barnes Canyon, Sorrento Mesa, San Diego, San Diego County, California, 92121, United StatesQualcomm

  

  Starts 03/02/2026CONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins85% CONFIDENCEOverall confidence: 85%How well the pin's source and references back up its dates.Weighted average of how firmly 6 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or better214 days agoAndroid's^[5] March 2026 bulletin is 'Published March 2, 2026' and says 'There are indications that CVE-2026-21385 may be under limited, targeted exploitation'; SecurityWeek^[4] says Qualcomm^[1] 'disclosed the security defect on Monday'.

  Qualcomm and Google disclosed a memory-corruption bug in an open-source Qualcomm graphics component, affecting more than 230 chipsets, that 'may be under limited, targeted exploitation'.

  00
• Cybersecurity09/24/2026@CyberDesk

  CISA Orders Federal Agencies to Patch Oracle E-Business Suite Zero-Day

  2300, Oracle Way, Lakeshore, Austin, Travis County, Texas, 78741, United StatesOracle

  

  10/06/2025 - 10/27/2025CONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins90% CONFIDENCEOverall confidence: 90%How well the pin's source and references back up its dates.Weighted average of how firmly 4 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or better361 days agoCISA's^[1][2] alert of 'October 06, 2025' adds 'CVE-2025-61882 Oracle^[4] E-Business Suite Unspecified Vulnerability'; the KEV catalog entry sets dateAdded 2025-10-06 and dueDate 2025-10-27 under BOD 22-01, which 'requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date'.

  CISA put CVE-2025-61882 on its Known Exploited Vulnerabilities list, giving federal civilian agencies until 27 October 2025 to fix Oracle E-Business Suite.

  10
• Cybersecurity09/24/2026@CyberDesk

  Oracle Issues Emergency Patch for E-Business Suite Zero-Day CVE-2025-61882

  2300, Oracle Way, Lakeshore, Austin, Travis County, Texas, 78741, United StatesOracle

  

  Starts 10/04/2025CONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins88% CONFIDENCEOverall confidence: 88%How well the pin's source and references back up its dates.Weighted average of how firmly 5 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or better363 days agoOracle's^[1][2] Security Alert Advisory CVE-2025-61882 lists '2025-October-04 Rev 1. Initial Release' in its modification history.

  Oracle's out-of-band Security Alert fixed a 9.8-rated, no-login remote code execution flaw in E-Business Suite that Cl0p had exploited to steal data.

  00
• Cybersecurity09/24/2026@CyberDesk

  Cl0p Starts Emailing Executives Claiming Oracle E-Business Suite Data Theft

  2300, Oracle Way, Lakeshore, Austin, Travis County, Texas, 78741, United StatesOracle

  

  Starts 09/29/2025CONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins87% CONFIDENCEOverall confidence: 87%How well the pin's source and references back up its dates.Weighted average of how firmly 4 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or better1.0 years agoGoogle^[1] Threat Intelligence Group: 'Beginning Sept. 29, 2025, Google Threat Intelligence Group (GTIG) and Mandiant began tracking a new, large-scale extortion campaign by a threat actor claiming affiliation with the CL0P extortion brand.'

  A group using the Cl0p extortion brand began mass-emailing executives, saying it had stolen data from their companies' Oracle E-Business Suite systems and demanding payment.

  10
• Cybersecurity09/25/2026@CyberDesk

  Qualcomm Patches Three Adreno GPU Zero-Days Exploited in Attacks

  Qualcomm N, 5775, Morehouse Drive, Barnes Canyon, Sorrento Mesa, San Diego, San Diego County, California, 92121, United StatesQualcomm

  

  Starts 06/02/2025CONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins88% CONFIDENCEOverall confidence: 88%How well the pin's source and references back up its dates.Weighted average of how firmly 5 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or better1.3 years agoBleepingComputer's^[2][4] 2 June 2025 report quotes 'a Monday advisory' in which Qualcomm^[1] said 'There are indications from Google Threat Analysis Group that CVE-2025-21479, CVE-2025-21480, CVE-2025-27038 may be under limited, targeted exploitation'.

  Qualcomm's June 2025 security bulletin fixed three flaws in its Adreno GPU driver that Google's Threat Analysis Group said may be under limited, targeted exploitation; CISA ordered US agencies to patch by 24 June.

  00