Skip to content
Patcharo

CVE monitoring for IT and security teams

Know what to fix. And which update to apply.

Patcharo matches your software versions with known vulnerabilities and vendor fixes, helping you prioritize updates.

Start free trial See Patcharo in action

14 days to evaluate Patcharo across your environment. No credit card.

  • Technologies covered
  • Check Point
  • Fortinet
  • Palo Alto Networks
  • Cisco

See what Patcharo recommends for your version.

Choose a product and version to explore relevant vulnerabilities and identified updates.

BRANCH-FGT-02· FortiOSFictional appliance · real CVEs

Your next action

Upgrade to 7.4.11

Action required

7.4.3→7.4.11

Resolves 28 CVEs · 4 known exploited

Closed by this release

and 25 more CVEs

Why this priority?Priority 100/100
  • Known exploited (CISA KEV)
  • 30% exploitation probability (EPSS)
  • Critical severity
  • High severity
  • Internet exposed
  • Production

The score adds visible reasons and is capped at 100. No model weighs anything.

Sources · CVE-2026-24858

The documents behind the most urgent record of this release.

Fix confirmed by the vendor's statement

Patcharo recommends the release; your team applies it, then records the new version to verify.

A fictional appliance evaluated live against the catalog of 1 Oct 2026 with the application's own matcher. Every CVE is real; no asset belongs to a customer.

Why generic alerts fail

A CVE is not a verdict. The exact release is.

The same vulnerability is exploitable on one release, fixed on the next and absent from a third. Patcharo reads the ranges the vendor publishes and answers for the version you actually run.

01

Every CVE of every vendor

Public feeds list everything. Your appliances are concerned by a handful of records, and only at certain releases.

02

The hotfix changes the answer

A PAN-OS hotfix or a Check Point Jumbo Hotfix Take turns Affected into Fixed. Without it, every alert is a false positive to verify by hand.

03

Five sources, five formats

NVD, CISA KEV, FIRST EPSS, vendor PSIRT pages and CERT-FR, each on its own schedule, and none of them knows your inventory.

One CVE, three releases, three answersIllustration
CVE-2026-0257KEVRansomwareCriticalPAN-OS

  • 11.1.2-h1

    First fixed release · 11.1.4-h33

    Affected

  • 11.1.16-h1

    The installed release is at or past the fix on an affected branch.

    Fixed

  • 10.1.14-h8

    This release is not in Patcharo's data: no source mentions it, so the vendor's general statement is not applied.

    Unknown
A fictional estate of 4 appliances, evaluated live against today's catalog with the application's own matcher. Every CVE is real; no asset belongs to a customer.

How it decides

From your stack to a prioritized action

  1. 01

    Describe your stack

    Vendor, product, exact release and patch level for each appliance, from searchable lists. A custom value stays custom, never guessed.

    Vendor
    Palo Alto Networks
    Product
    PAN-OS
    Installed version
    11.1.2-h1

    Recognized release

  2. 02

    Read the status of each CVE

    The vendor's affected and fixed ranges are applied to each exact version. Five explicit statuses, each with its source.

    • CVE-2026-0301Affected
    • CVE-2024-3382Fixed
    • CVE-2025-4231Not affected
  3. 03

    Act in the right order

    One upgrade that closes several CVEs, ranked by exploitation, exposure and criticality, then verified against the version you record.

    11.1.2-h1→11.1.16-h1

    Resolves 29 vulnerabilities · 8 known exploited

UnknownUnknown never becomes Not affected. When the data cannot decide, Patcharo says so.

The product

One page that answers: what needs attention today?

The dashboard counts the open bundles, the affected assets and the known exploited exposures of your estate, lists today's priorities and what changed in the catalog for your products.

app.patcharo.com/dashboardIllustration

What needs attention

4 assets · catalog of 1 Oct 2026

  • Actions required4
  • Affected assets3
  • Known exploited15
  • Needs review3

Today's priorities

  • EDGE-FW-01 · 11.1.16-h1Priority score 100
  • BRANCH-FGT-02 · 7.4.11Priority score 100
  • DC-CPGW-03 · R81.20 JHF Take 166Priority score 91

What changed

A fictional estate of 4 appliances, evaluated live against today's catalog with the application's own matcher. Every CVE is real; no asset belongs to a customer. 260 vulnerabilities tracked · 150 known exploited · updated 1 Oct 2026

  • Advisories, watched

    Fortinet and Palo Alto Networks PSIRT feeds read every 15 minutes, CERT-FR and CISA KEV with every sync; one e-mail per event.

  • Bundles and patch delta

    One target release per asset: what it resolves, what remains, what it would introduce.

  • Evidence on every status

    Source, affected range, first fixed release, retrieval time and matcher version.

  • An MSSP console

    Isolated customer organizations, alerts routed per operator, reports per customer.

Built for

The people accountable for exposure

  • CISOs

    A sourced answer to “are we affected?” and an exception register that expires.

  • SOC teams

    Known exploited and CERT-FR alerts matched to the exact versions you run, not to a vendor name.

  • Security engineers

    Remediation bundles with their evidence and patch delta, ready for a change request.

  • Network and system administrators

    One target release per appliance and a maintenance planner that groups identical upgrades.

  • MSSPs

    Isolated customer workspaces, one console across them, alerts routed per operator.

Pricing

Simple pricing, full truth on every plan

Plans limit volume and users, never the vulnerability truth. Every plan starts with a 14-day free trial.

  • Solo

    For an independent engineer or a small estate.

    €19/ month excl. VAT

    • 10 assets
    • 1 user
    Start free trial

  • Team

    For security and network teams.

    €59/ month excl. VAT

    • 100 assets
    • 5 users
    Start free trial

  • Business MSSP

    For MSSPs managing their customers' estates.

    €149/ month excl. VAT

    • 10 managed customers
    • 300 assets in total
    • 15 users
    Activate Business MSSP

  • Enterprise

    Custom volumes and support terms.

    Contact us

    • Custom customers, assets and users
    Contact sales

Asset boosters · Solo +10 assets · €10 / month · Team +50 assets · €30 / month · Business MSSP +150 assets · €60 / month

Compare the plans in detail

FAQ

Questions teams ask before they start

Methodology
Does an AI decide whether my version is affected?

No. Matching is deterministic: the vendor's affected and fixed ranges are applied to the exact release you record, with the vendor's own version scheme. AI is never used to decide a status.

Which products are matched at version level?

Palo Alto Networks PAN-OS; Fortinet FortiOS, FortiProxy, FortiManager, FortiAnalyzer and FortiWeb; Check Point Security Gateway and Security Management with Jumbo Hotfix Takes. Cisco advisories are listed. Anything outside this coverage is shown as not covered, never as safe.

What happens when the data cannot decide?

The finding stays Unknown or Needs review, with the reason. Patcharo never turns a missing fact into Not affected or Fixed.

How do alerts work?

You choose what to receive by e-mail: new CVEs, CISA KEV listings, CERT-FR advisories, vendor recommendation changes, at the frequency you set. One e-mail per event, and nothing retroactive when you add a watch.

Where does my inventory live?

In your own workspace, isolated from every other customer. Custom values you enter are never used to recognize other users' versions.

What happens after the trial?

Your data stays readable. Choose a plan to keep adding and changing assets.

See what affects your estate today

Create an account, add a few appliances with their exact versions and get your first prioritized actions in minutes.

Start free trial Talk to us