Skip to content
Noroxi

Patch TuesdaySeptember 2026

On the second Tuesday of each month Microsoft, Adobe, SAP, Siemens and Schneider Electric publish in bulk; Oracle on the third Tuesday of January, April, July and October. Records published that day, from our own database, sorted by action score: KEV and mature exploits first.

How it is computed: CNA stamp + publication date (two-day window, UTC). No claim of a one-to-one match with the vendor bulletin; out-of-band updates land on other days.

583 records · 2 KEV

Affecting your stack

This month's records that match the products and versions in your stack.

Sign in to see the ones matching your stack; records and notifications are free. →

Microsoft · September 8

400 · 2 KEV · 42 critical

+388 moreAll records of the vendor

Adobe · September 8

167 · 0 KEV · 6 critical
  • CVE-2026-82004
    41Plan

    Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

    CriticalCVSS 10.0No exploitEPSS 3%

    adobe · campaignSep 8, 2026

  • CVE-2026-19232
    39Monitor

    Adobe Experience Manager | Incorrect Authorization (CWE-863)

    CriticalCVSS 9.9No exploitEPSS 0%

    adobe · experience managerSep 8, 2026

  • CVE-2026-48273
    39Monitor

    ColdFusion | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)

    CriticalCVSS 9.9No exploitEPSS 1%

    adobe · coldfusionSep 8, 2026

  • CVE-2026-76200
    37Monitor

    Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

    CriticalCVSS 9.3No exploitEPSS 0%

    adobe · magentoSep 8, 2026

  • CVE-2026-76201
    37Monitor

    Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

    CriticalCVSS 9.3No exploitEPSS 0%

    adobe · commerceSep 8, 2026

  • CVE-2026-75746
    36Monitor

    ColdFusion | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

    CriticalCVSS 9.1No exploitEPSS 0%

    adobe · coldfusionSep 8, 2026

  • CVE-2026-81996
    35Monitor

    Acrobat Reader | Incorrect Authorization (CWE-863)

    HighCVSS 8.8No exploitEPSS 0%

    adobe · acrobatSep 8, 2026

  • CVE-2026-75990
    34Monitor

    Illustrator | Incorrect Authorization (CWE-863)

    HighCVSS 8.6No exploitEPSS 0%

    adobe · illustratorSep 8, 2026

  • CVE-2026-75991
    34Monitor

    Illustrator | Improper Input Validation (CWE-20)

    HighCVSS 8.6No exploitEPSS 0%

    adobe · illustratorSep 8, 2026

  • CVE-2026-75993
    34Monitor

    ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)

    HighCVSS 8.5No exploitEPSS 0%

    adobe · coldfusionSep 8, 2026

  • CVE-2026-76190
    34Monitor

    ColdFusion | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)

    HighCVSS 8.6No exploitEPSS 0%

    adobe · coldfusionSep 8, 2026

  • CVE-2026-76199
    34Monitor

    Photoshop Desktop | Uncontrolled Search Path Element (CWE-427)

    HighCVSS 8.6No exploitEPSS 0%

    adobe · photoshopSep 8, 2026

+155 moreAll records of the vendor

SAP · September 8

0 · 0 KEV · 0 critical

No records in this window.

Siemens · September 8

13 · 0 KEV · 4 critical
  • CVE-2026-62645
    37Monitor

    A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70).

    CriticalCVSS 9.3No exploitEPSS 0%

    siemens · reyrolle 7sr5Sep 8, 2026

  • CVE-2026-62647
    37Monitor

    A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70).

    CriticalCVSS 9.3No exploitEPSS 0%

    siemens · reyrolle 7sr5Sep 8, 2026

  • CVE-2026-62646
    36Monitor

    A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70).

    CriticalCVSS 9.1No exploitEPSS 0%

    siemens · reyrolle 7sr5Sep 8, 2026

  • CVE-2026-67367
    36Monitor

    A vulnerability has been identified in SIMOVE Fleetmanager V3.1 (All versions < V3.1.13), SIMOVE Fleetmanager V3.2 (All versions < V3.2.4),

    CriticalCVSS 9.2No exploitEPSS 1%

    siemens · simove fleetmanager v3.1Sep 8, 2026

  • CVE-2026-50093
    35Monitor

    A vulnerability has been identified in Siveillance Control Pro V3.0 (All versions < V3.0.12.2173), Siveillance Control Pro V4.0 (All version

    HighCVSS 8.9No exploitEPSS 0%

    siemens · siveillance control pro v3.0Sep 8, 2026

  • CVE-2026-34223
    34Monitor

    A vulnerability has been identified in Desigo CC ClickOnce Client V6 (All versions), Desigo CC ClickOnce Client V7 (All versions), Desigo CC

    HighCVSS 8.6No exploitEPSS 0%

    siemens · desigo cc clickonce client v6Sep 8, 2026

  • CVE-2026-58113
    34Monitor

    A vulnerability has been identified in Teamcenter V2412 (All versions < V2412.0013), Teamcenter V2506 (All versions < V2506.0010), Teamcente

    HighCVSS 8.5No exploitEPSS 0%

    siemens · teamcenter v2412Sep 8, 2026

  • CVE-2026-62648
    34Monitor

    A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70).

    HighCVSS 8.7No exploitEPSS 0%

    siemens · reyrolle 7sr5Sep 8, 2026

  • CVE-2026-62649
    34Monitor

    A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70).

    HighCVSS 8.7No exploitEPSS 0%

    siemens · reyrolle 7sr5Sep 8, 2026

  • CVE-2026-62650
    34Monitor

    A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70).

    HighCVSS 8.7No exploitEPSS 0%

    siemens · reyrolle 7sr5Sep 8, 2026

  • CVE-2026-62653
    28Monitor

    A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70).

    HighCVSS 7.0No exploitEPSS 0%

    siemens · reyrolle 7sr5Sep 8, 2026

  • CVE-2026-62654
    28Monitor

    A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70).

    HighCVSS 7.0No exploitEPSS 0%

    siemens · reyrolle 7sr5Sep 8, 2026

+1 moreAll records of the vendor

Schneider Electric · September 8

3 · 0 KEV · 0 critical
  • CVE-2026-19233
    34Monitor

    CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized command execution and disclosure of server da

    HighCVSS 8.6No exploitEPSS 0%

    schneider electric · ecostruxure™ it data center expert (formerly known as struxureware data center expert)Sep 9, 2026

  • CVE-2026-77120
    34Monitor

    CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause pri

    HighCVSS 8.7No exploitEPSS 0%

    schneider electric · powerlogic t300Sep 9, 2026

  • CVE-2026-8044
    34Monitor

    CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability exists that could cause remote code

    HighCVSS 8.6No exploitEPSS 0%

    schneider electric · ecostruxure™ it data center expert (formerly known as struxureware data center expert)Sep 9, 2026

All records of the vendor