Firmware branch check: Is your firewall or VPN version still inside a known-exploited CVE?
Pick your firewall, VPN gateway or file-transfer server and type the version it runs. We list every CVE on CISA's known-exploited list for that product that still applies to your exact version by NVD's data, and the fixed release on your branch, or say plainly that your branch has no fix and which release does.
What it does
- FortiOS, Ivanti Connect Secure, PAN-OS, Cisco ASA, NetScaler, SonicWall, Exchange, MOVEit, GoAnywhere, CrushFTP, phpMyAdmin, Adminer
- Your exact version against NVD's affected ranges and listed builds, CVE by CVE
- The fixed release on your branch, or "no fix on this branch, move to X" (FortiOS 7.2 after CVE-2025-68686)
- Ransomware use and the date CISA listed it, with the vendor advisory and NVD links
- Public input only: you type a version, nothing contacts your device
What goes in, what comes out
- What goes in
- A product from the list and the version it runs, as the vendor writes it (7.2.11, 22.7R2.5, 10.2.9-h1, 14.1-43.56, 2019 CU14).
- What comes out
- Each known-exploited CVE for that product: still applies, not in the affected range, or not mapped by NVD yet; the fixed release on your branch or the note that there isn't one; vendor advisory and NVD links.
- Example
- FortiOS 7.2.11 on 23 October 2026: 1 of 15 known-exploited CVEs still applies, CVE-2025-68686, with no fixed 7.2 release (the first fixed release is 7.4.7).
- Limits
- Only CVEs on CISA's known-exploited list, and only as precise as NVD's version data, which can lag the vendor advisory. FIPS and NDcPP builds aren't covered. 20 checks a day per IP address without an account. A patched version doesn't remove what an attacker left before the patch.