PatchAlert

PatchAlert

Early access · Android · United States

Know when a product you run is on CISA’s exploited list

PatchAlert alerts you when a product you picked appears in the CISA Known Exploited Vulnerabilities catalog, and helps you track patching across your locations.

Early access on Google Play How it works

Early access: all features are free. Built for IT workers.

Example of the Status ring in the app. It shows one of three states: open alerts, entries to review, or no open alerts.
The Status ring in the app, cycling through its three states:
  • 3 open alerts, 1 overdue
  • 4 to review
  • No open alerts

The catalog PatchAlert watches

exploited vulnerabilities in the catalog
1,781
products
741
vendors
295
added in the past 12 months
322
known to be used in ransomware campaigns
361

CISA Known Exploited Vulnerabilities catalog, version 2026.11.13, released November 13, 2026. PatchAlert checks the catalog every 6 hours; these numbers are from the version above.

How it works

  1. Pick what you run. Choose products for each location, or follow a whole vendor.
  2. Get an alert. When CISA adds an exploited vulnerability for one of them, PatchAlert sends a push notification (“Active exploitation:” and the product) with the CISA federal due date and the affected locations.
  3. Record what you did. For each location, record patched, mitigated, not affected, or deferred with a review date. See what is overdue and export a remediation report.

What an alert looks like

One notification, only for what you picked

The title says Active exploitation: and the product as CISA lists it. The body gives the CISA federal due date (the deadline CISA sets for US federal agencies, which many organizations use as a target) and which of your locations it affects. Tap it to open the alert.

CISA can list a vulnerability days after the vendor announces it, so keep vendor notices on too.

Illustration with an example product. Notifications look slightly different on each phone.

PatchAlertnow

Active exploitation: Fortinet FortiOS and FortiProxy

CISA federal due date Nov 6. Affects: HQ, Branch

Example push notification.

Inside the app

Screenshots show test data (CVE-2099 entries and test locations), not customer data.

01 · Status

See what is open, and what to do first

The Status ring counts open alerts and what is overdue, names the top priority, keeps deferred alerts in their own group with their review dates, and lists catalog entries to review that were added before you started watching.

Status screen: a red ring with 5 open alerts, its dot partway around the ring, and 1 deferred shown as a smaller count; 2 overdue; the top priority (a Cisco IOS XE test alert, overdue 25 days); a Deferred group with a Microsoft Exchange Server test alert deferred until Nov 23; and counts at a glance.

02 · Alerts

Countdowns in words, not just colors

Each alert shows a countdown to the CISA federal due date, which locations it affects, and whether it is known to be used in ransomware. Deferred alerts stay in their own group until their review date.

Alerts list: open test alerts with countdowns in words and the CISA federal due date, one tagged ransomware, then a Deferred group with an alert deferred to Nov 23, then the collapsed Done group.

03 · Outcomes

Record what you did, in two taps

For each location, record patched, mitigated, not affected, or deferred until a review date, with an optional note. A deferred alert returns to Open on its review date. The alert shows the CISA federal due date first, and why it matched when CISA files a product under another name.

Outcome picker for a test alert at My Location: a note field with the text Change ticket CHG-2817 and a hint not to enter passwords or personal information, the review date for Deferred, and the four outcomes Patched, Mitigated, Not affected and Deferred, each with what it means.

04 · Report

A remediation report for your records

Patch rate, on-time rate and median time to patch for any period and location, the top priority now, and a PDF export.

Remediation report for the last 90 days: outcomes 5 open, 7 patched, 1 mitigated, 1 not affected, 1 deferred; 13 received, 7 of 15 patched, 71 percent on time, median 3 days to patch, 5 open, 2 overdue; and the top priority.

What PatchAlert does not do

PatchAlert does not scan your network or check your systems. It shows what the CISA catalog lists for the products you picked, and outcomes are what you record in the app. It is an informational service: there is no guarantee that every vulnerability is covered or that every alert is delivered, so keep following your vendors' own advisories.

Early access is free

All features are free during early access, on Android in the United States.

Early access on Google Play