Release calendar & vendors
Each vendor's security release cadence, checked against its official pages on Oct 15, 2026. Re-check before relying on it.
| Vendor | Cadence | Verification | Official source |
|---|---|---|---|
| Microsoft | Patch Tuesday: monthly, 2nd Tuesday | Not re-checked in this pass | https://msrc.microsoft.com/update-guide |
| Cisco | 1st & 3rd Wednesday monthly, 16:00 UTC (since July 2026); the policy page still lists semiannual bundles | Confirmed (two Cisco documents conflict) | https://sec.cloudapps.cisco.com/security/center/resources/risk-based-disclosure |
| Oracle | Critical Patch Update: quarterly (Jan/Apr/Jul/Oct) | To verify (exact day) | https://www.oracle.com/security-alerts/ |
| VMware / Broadcom | No fixed schedule (VMSAs as needed) | Confirmed: no cadence stated | https://www.broadcom.com/support/vmware-services/security-response |
| Fortinet | Monthly, 2nd Tuesday; critical issues may come out of cycle | Confirmed | https://fortiguard.fortinet.com/psirt_policy |
| Palo Alto Networks | Monthly, 2nd Wednesday 09:00 PT | Confirmed | https://www.paloaltonetworks.com/product-security-assurance |
| SAP | Security Patch Day: monthly, 2nd Tuesday | Not re-checked in this pass | https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html |
| Citrix | 2nd Tuesday "when possible"; out-of-band releases are common | Confirmed | https://www.cloud.com/content/dam/cloud/documents/psirt-policy-2-0.pdf |
Coming soonDated calendar entries (next release dates) coming soon