Next week’s patch calendar: four KEV deadlines and a Patch Tuesday

Next week stacks up. Four federal patch deadlines from CISA’s Known Exploited Vulnerabilities catalog fall between Tuesday, November 10 and Friday, November 13, 2026, and Microsoft and Fortinet both publish on Patch Tuesday, November 10. None of this is new on its own. Together it is a full week of change windows for a small IT team, and it is easier to plan on Wednesday than to discover on Monday.

This is a calendar, not a fresh alert. We covered the Magento and Brotli listings and the Ivanti listing when they were added. What follows puts every date in one place, checked against CISA’s catalog feed version 2026.11.03, released November 3 at 3:00 PM ET.

The calendar

Swipe the table sideways to see every column.

The catalog marks known ransomware use as Unknown for all five CVEs. Federal due dates bind only federal civilian agencies under BOD 26-04. For a private firm they are a priority signal: CISA lists a flaw only when it has evidence of exploitation.

What each listing is

• Adobe Commerce and Magento, CVE-2026-48356. CISA describes an unrestricted upload of a file with a dangerous type (CWE-434) that could result in arbitrary code execution. The fix is in Adobe security bulletin APSB26-73.
• Google Brotli, CVE-2026-111497. An unchecked return value (CWE-252, CWE-787) that lets a remote, unauthenticated attacker corrupt decoder memory with a crafted compressed stream, which can disclose memory, crash the process or potentially run code. Brotli is a library inside many products, so the fix is Brotli 1.2.1 or a vendor update that includes it. CISA’s entry says the flaw “could be used by different products.”
• Broadcom VMware ESX, CVE-2026-41709. Insufficient logging (CWE-778): an attacker who already has admin access can perform some operations without being logged. It is not an entry point. It is a way to hide. That is why it is on an exploited list.
• Ivanti Connect Secure, CVE-2026-118527. Generation of predictable identifiers (CWE-340) that lets an authenticated attacker upload attacker-controlled files to a known location. CISA notes it can be chained with CVE-2026-104935 and CVE-2026-111357. The second of those was due November 2.

Patch Tuesday, November 10

November 10 is the second Tuesday of the month, Microsoft’s regular release day. As of this morning, Microsoft’s security update API lists releases through October (published October 13) and no November release yet, which is normal before the day. We will not guess at its contents.

Fortinet is the less routine item. In an October 21 post, Fortinet CISO Carl Windsor said a coordinated hardening release for FortiOS, FortiManager and FortiAnalyzer would ship October 22, with fixes for vulnerabilities found through what Fortinet calls its frontier AI-assisted testing program. The post says the fixes include critical and high-severity issues and that public advisories will be published on November 10. The fixed versions are listed now: for example FortiOS 7.4.13, 7.6.8 and 8.0.2 or above.

That gap matters. Fortinet itself warns that once advisories and patches are public, attackers can diff the fix to find the weakness, and that AI tools can shorten the time from patch to working exploit to “hours or days.” If you have a FortiGate on the internet and it is not on a fixed version, November 10 is the day the details become public, not the day the risk starts.

What it means for CFOs and CISOs

• Plan the week as one change window, not six. The Microsoft release, the Fortinet upgrade and the VMware and Ivanti fixes touch different systems, but often the same one or two people. Book their time now.
• Edge devices first. Ivanti Connect Secure and FortiGate sit on the internet by design. They are the systems most often used as an entry point, and both appear on this calendar.
• Third-party code is the harder question. Brotli is a component, not a product. You will rarely patch it yourself; you will ask your vendors whether their product includes an affected version. An SBOM makes that a lookup instead of an email chain. Our SBOM request pack is built for exactly that ask.
• Agencies and managed providers count. If an agency hosts your store or an MSP runs your firewall, the deadline is still yours to track. Ask in writing.

What to do this week

1. Inventory by Friday. Answer four yes-or-no questions: do we run Magento or Adobe Commerce, VMware ESX, Ivanti Connect Secure, or any Fortinet device? Write the owner’s name next to each yes.
2. Fortinet now. Check the FortiOS, FortiManager and FortiAnalyzer versions against the fixed versions in Fortinet’s post. Upgrade before November 10. If you cannot, Fortinet’s own interim advice is to restrict admin interfaces to trusted IP addresses and keep FortiManager off the internet.
3. Magento by Tuesday. Apply APSB26-73 or confirm in writing that your agency has. Ask when, and for which store.
4. Email your key software vendors about Brotli. One line: does your product include Google Brotli, and if so, is it on 1.2.1 or otherwise patched for CVE-2026-111497?
5. VMware and Ivanti by Wednesday and Friday. Apply Broadcom’s and Ivanti’s fixes from the advisories CISA links. For Ivanti, confirm the earlier chained fixes are also in.
6. Book Patch Tuesday. Hold a two-hour window on Wednesday, November 11 to read the Microsoft release and push it to a pilot group first.
7. Check admin logins. These flaws reward stolen admin credentials. Confirm MFA is on for every firewall, VPN, hypervisor and store admin account, and that no admin password is shared in a spreadsheet. Our password manager guide covers how to fix that for a small team.

What to watch next

• Microsoft’s November release on November 10, and whether any of its fixes are flagged as already exploited. Those tend to reach the KEV catalog within days.
• Fortinet’s PSIRT advisories on November 10. Watch for CVE numbers, severity scores, and any later note that a flaw is being exploited.
• New KEV additions. CISA’s feed updates as listings are added, and three-day deadlines, as with WordPress last week, are now common.

We publish a free weekly roundup of newly exploited vulnerabilities: what they are, who is affected and what to patch first. Subscribe free to get it. If you want help deciding what applies to you, our Quick Answer service covers that question.

Sources

• CISA Known Exploited Vulnerabilities catalog JSON feed, version 2026.11.03, 1,767 entries, checked November 4, 2026
• CISA Known Exploited Vulnerabilities catalog
• Adobe security bulletin APSB26-73
• Google Brotli 1.2.1 release
• Broadcom VMware security advisory
• Ivanti Connect Secure security advisory
• Microsoft Security Response Center, security updates API, checked November 4, 2026
• Fortinet, “Fortinet Releases Security Hardening Release for Multiple Products,” Carl Windsor, October 21, 2026
• BOD 26-04, Prioritizing Security Updates Based on Risk

Related: WordPress is on the exploited catalog. Get to 7.1.4 this week. and Security and vulnerabilities, every security briefing, guide and tool in one place.