Three priority tiers.
Not every vendor patch deserves your attention this week. These are the heuristics I apply when triaging a release — consistent with the patching priority framework I've published separately.
Priority tiers — what the tags mean
The 38-vendor watch list.
Every vendor below publishes at a cadence I actively monitor. Each card describes their release rhythm, the components I prioritize, and the heuristic I use to decide if a given CVE gets IMMEDIATE treatment versus the normal patch window. Organized by category — tap any vendor to expand.
Endpoint Security · AV · EDR · XDR
🦅 CrowdStrike — Falcon sensor & cloud
🛡️ SentinelOne — Singularity agent
🟦 Microsoft Defender — for Endpoint / XDR
🟧 Broadcom / Symantec — Endpoint Protection
🔵 Sophos — Intercept X · Firewall · Central
🟢 ESET — PROTECT · Endpoint · Server
🟥 Trend Micro — Vision One · Deep Security · Apex One
🐻 Bitdefender — GravityZone
AI Platforms · LLM APIs · ML Infrastructure
🤖 OpenAI — API · ChatGPT Enterprise · Azure OpenAI
🧠 Anthropic — Claude API · Claude for Enterprise
💎 Google — Gemini · Vertex AI · Workspace AI
🦙 Meta — Llama · Llama Guard · PyTorch
⚡ NVIDIA — AI Enterprise · NeMo · Triton · GPU drivers
🤗 Hugging Face — Hub · Transformers · Inference Endpoints
from_pretrained), Spaces sandbox escapes, and ecosystem typosquats.Database Platforms · Data Warehouses
🏛️ Oracle — Database · WebLogic · Fusion Middleware
📘 Microsoft SQL Server — all supported versions
xp_cmdshell-adjacent advisory. Don't forget Azure SQL Managed Instance.🐘 PostgreSQL — community core + major forks
🍃 MongoDB — Community · Enterprise · Atlas
🐬 MySQL / MariaDB — CE + Percona
❄️ Snowflake — Data Cloud · Native Apps
🔴 Redis — OSS · Stack · Enterprise
🔍 Elastic — Elasticsearch · Kibana · Logstash
Enterprise SaaS · Platforms · Collaboration
⚙️ SAP — HANA · S/4HANA · NetWeaver · BTP
☁️ Salesforce — Core · Commerce · Marketing Cloud
🔧 ServiceNow — Now Platform · Utah / Vancouver / Washington
🐙 Atlassian — Jira · Confluence · Bitbucket Server
🐈 GitHub · GitLab — Enterprise Server + SaaS
📞 Zoom — Client · Rooms · Workplace
🔴 Adobe — Acrobat · Reader · ColdFusion · Commerce
Open Source · Runtimes · Containers
🌐 Apache — httpd · Tomcat · Struts · ActiveMQ
🚀 nginx — OSS + Plus
🔐 OpenSSL — 3.x + FIPS provider
🐳 Docker · containerd · runc
⎈ Kubernetes · kube-apiserver · ingress
🦕 Node.js · Python · .NET · Go · Rust
Specific releases, chronological.
The watch list above is the roster; the log below is what actually dropped. Each entry is a specific release with priority call and KEV overlap.
🪟 Microsoft — Patch Tuesday April 2026
Patch priority call
Immediate for Exchange Server; This Week for the rest. The Exchange CVE requires authentication but every Exchange install has thousands of low-privilege mailboxes that meet that bar, and the Transport service runs as SYSTEM — this is the same shape as ProxyLogon and ProxyNotShell, and defenders who learned nothing from 2021 will learn again. If you are still running on-prem Exchange in 2026, you have a two-day window: patch, then run the Microsoft Exchange Health Checker script, then check for webshells in \inetpub\wwwroot\aspnet_client and under the OWA virtual directory. The other two critical CVEs are in RRAS and HTTP.sys — both exploitable but only relevant if you are exposing those services, which almost nobody should be. For the 115 non-critical fixes, the only standout is a Windows Kernel EoP (CVE-2026-29087) that is already in KEV by Wednesday; prioritize it on domain controllers and privileged access workstations. See patching-priority framework for how I stage a month like this.
🌐 Google Chrome — 135.0.7049.84 emergency
Patch priority call
Immediate. When Google ships a single-CVE emergency build and attributes in-the-wild exploitation to TAG, the exploit is typically already in a commercial spyware toolchain and has been for weeks before disclosure — the pattern from the last eight V8 zero-days is consistent. Force Chrome update enterprise-wide tonight via Intune, Jamf, Workspace, or your MDM of choice; do not wait for the user-driven "Relaunch Chrome" prompt to cycle through, because the average user ignores it for 4+ days. The companion action: confirm Edge (same V8 engine) and any Electron-based app in your fleet (Slack, Teams, Notion, 1Password desktop, VS Code) gets its own patch cycle — Electron lags Chromium by 1 to 3 weeks and is the long tail of this CVE. For managed Chromebooks, this is a forced restart. For BYOD, you cannot force anything; update your threat model accordingly.
🍎 Apple — iOS 18.5 / macOS 15.5
Patch priority call
Immediate for anyone in an elevated-risk role — executives, legal, journalists, activists, M&A deal teams, security staff who carry sensitive data on device. Enforce via MDM (Jamf Pro, Intune, Kandji, Mosyle) as a required minimum OS version with a 48-hour grace period; block access to corporate email and VPN below that version. For everyone else, This Week is fine, but do not let it slip into the following Patch Tuesday cycle because iOS users drift faster than Windows users and the WebKit component is reachable from any rendered HTML in Mail preview, iMessage link unfurls, and in-app browsers. Turn on Lockdown Mode for the named at-risk group if you have not already — it meaningfully reduces the WebKit and JavaScriptCore attack surface and the usability cost is lower than most security leads assume. Remember Apple will not backport to iOS 17; any device on the older major version is now a known-vulnerable asset and should be on a documented replacement plan.
🪟 Microsoft — Patch Tuesday March 2026
Patch priority call
This Week, but the Outlook NTLM-leak CVE deserves Immediate treatment in any environment that still has NTLM enabled on domain controllers or on internet-exposed services. The exploitation pattern is straightforward: attacker sends a meeting invite with a UNC path pointing at an attacker-controlled SMB host, Outlook renders the invite, Windows helpfully authenticates with the user's NTLM hash. That hash is crackable offline or usable directly via relay attacks against LDAP, SMB, and AD-CS. Patch Outlook, yes — but also take this month to run Get-ADDefaultDomainPasswordPolicy, confirm your Exchange Online transport rules block external-sender UNC paths, and stand up the Entra ID NTLM decommissioning plan that Microsoft has been asking you to start since 2024. The other four critical CVEs are in the expected places (Windows Hyper-V, SharePoint, Azure Connected Machine Agent); patch on the normal two-week cycle unless you expose those services directly.
☁️ VMware — vCenter out-of-band advisory
Patch priority call
Immediate — drop everything. vCenter is the most valuable pivot point in almost any virtualized environment: compromising it grants full control of every ESXi host and every VM on the cluster, plus typically domain-admin-equivalent credentials cached in vCenter service accounts. Unauth RCE on vCenter is a once-or-twice-a-year event and every time it has happened (CVE-2021-21972, CVE-2021-21985, the 2023 DCERPC family) mass exploitation followed within 10 to 14 days. Patch tonight if possible. If you cannot patch tonight, the mitigation is strict: confirm vCenter management interfaces are not reachable from the user VLAN or the internet; put an ACL on the management interface that allows only the PAM jump hosts (CyberArk, Delinea, Teleport) on TCP 443/902/2012. Do not accept "it's behind the firewall" as an answer — every vCenter breach of the last five years was "behind the firewall." After patching, check vpxd.log and sps.log for anomalous DCERPC calls in the 30 days prior; the PoC was in private circulation before disclosure.
🪟 Microsoft — Patch Tuesday February 2026
Patch priority call
Routine. This is the quietest Patch Tuesday of Q1 2026 and you should treat it as a catch-up month: use the cycle to clean up the backlog from January, validate that your Intune/WSUS/Tanium deployment metrics are actually hitting 95%+ within the SLA window you claim in the audit reports, and rehearse the rollback procedure on a canary ring because you will need it during a louder month. The LDAP client CVE is worth noting only because client-side LDAP bugs have a bad history of becoming wormable once a public exploit drops; keep an eye on it for the next 60 days and move to Immediate if a working PoC lands. Do not skip the Azure fixes — the monthly Azure rollup includes a Machine Configuration extension fix (CVE-2026-14039) that affects Arc-enabled servers and tends to get ignored by on-prem teams who do not realize they inherited Arc agents from the hybrid identity project. Check your Arc inventory.
🛡️ Fortinet — FortiGate SSL-VPN advisory
Patch priority call
Immediate. If you have FortiGate SSL-VPN exposed to the internet — and if your FortiGate is edge, you almost certainly do — you should have patched before finishing this paragraph. The CVE is pre-auth, the PoC was in private circulation before disclosure, and Shadowserver is showing thousands of honeypot hits within 48 hours of the advisory. This is the third FortiGate SSL-VPN pre-auth in roughly 18 months; at some point the architectural conclusion has to be that SSL-VPN on edge appliances is a business decision, not a security one, and the decision is getting harder to defend. Tactical response: patch to the fixed firmware listed in FG-IR-26-011, then assume compromise during the exposure window — check /var/log/sslvpnd for unusual POST requests to /remote/ endpoints, check VPN user accounts for additions you did not make, and rotate every local admin credential on the appliance. Strategic: start the migration to ZTNA (Cloudflare, Zscaler ZPA, Netskope Private Access, Tailscale). The SSL-VPN replacement conversation is overdue in most shops.
🐧 Ubuntu — LTS kernel update (USN-7184-1)
Patch priority call
This Week for multi-tenant or shared-compute Linux fleets; Routine for single-tenant production workloads that do not run untrusted code. Netfilter local-privesc bugs are the most-exploited Linux kernel class of the last five years — every container-escape scenario involving a shared kernel (Kubernetes nodes with nodes shared across teams, Jenkins build runners, GitLab Runners, university HPC clusters, any multi-tenant VPS) treats this as an urgent fix, because a low-privilege pod or user who reaches root on the node effectively reaches root on every workload on that host. Single-tenant production DB servers with no interactive user accounts and no container runtime can wait for the normal maintenance window. Apply via unattended-upgrades if configured, or apt-get install --only-upgrade linux-image-generic with a scheduled reboot — livepatch covers most of these for Ubuntu Pro subscribers but confirm the exact CVE is in the livepatch feed before relying on it; some netfilter UAFs require a full reboot to fully remediate. Red Hat, Debian, and SUSE will ship equivalents within the week.
What's not in PatchGrid
I don't cover every vendor bulletin — that's what NVD is for. What lives here is the subset with one of: active exploitation, broad deployment footprint, management-plane exposure, or an exceptionally clean primitive (unauth RCE with a trivial exploit path). If a CVE doesn't fit any of those, it's routine maintenance and I don't clutter the grid with it.