CISA KEV Catalog: What Dental Practices Should Patch First

A single blue highlighted row lifted to the top of a long silver list of faded entries, representing a prioritized vulnerability

October 28, 2026 The Free Federal List That Tells Your Dental Practice What to Patch First: Making Sense of CISA’s KEV Catalog

Posted at 05:38h in IT Security by Raymond

On October 26, 2026, the U.S. Cybersecurity and Infrastructure Security Agency added two more vulnerabilities to a list most dental practices have never heard of — including a critical flaw in the PHP software that runs a large share of the web. It barely made the news, and that is exactly the problem. There are tens of thousands of known software vulnerabilities, your practice management system and imaging software stack carry dozens between them, and no office can patch everything the moment a fix appears. The question every practice quietly struggles with is simpler and sharper: of all the warnings, which ones actually matter this week? There is a free, public, federal answer to that question, and it is one of the most useful security tools your practice is not using.

What the KEV catalog actually is

CISA’s Known Exploited Vulnerabilities (KEV) catalog is a running list of software flaws that attackers are confirmed to be exploiting in the real world, right now. That last part is what makes it different from every other vulnerability feed. A vulnerability is only added to the KEV catalog when there is concrete evidence of active exploitation — not because it could theoretically be dangerous, but because someone is already using it to break into systems. The catalog grew out of a 2021 federal directive (BOD 22-01) that ordered government agencies to fix KEV-listed flaws on a deadline, and it has since become the single best public shortlist of what the attacking world is leaning on. It is free, it updates several times a week, and anyone — including a two-operatory dental office — can read it.

Why “just patch everything” quietly fails a practice

In a single monthly Microsoft update cycle, hundreds to well over a thousand vulnerabilities can be disclosed at once; we covered one such record Patch Tuesday and what it meant for dental practices earlier this month. Add the flaws in your imaging software, your network appliances, your website and every third-party plug-in, and the annual total runs into the tens of thousands. A busy practice with no full-time IT staff cannot triage all of that by severity score alone — and it turns out severity scores are a poor guide anyway. Most high-severity vulnerabilities are never exploited at all, while some that look moderate on paper become the entry point for a breach.

A large cloud of grey vulnerability icons funneling through a blue filter so only a few solid icons emerge — Severity scores flag thousands of issues a year; evidence of active exploitation is the filter that turns that noise into a short, actionable list.

Patching strictly “worst-first” by score means you spend scarce time on issues no one is attacking while a flaw that is being weaponized sits untouched. The KEV catalog inverts that: it tells you which ones have already crossed from theoretical to real.

What is on the list right now — and why it is aimed at you

The flaws CISA has added in recent weeks are not exotic. They cluster in exactly the places a dental practice is exposed: internet-facing remote-access gateways and VPN appliances, the web servers behind patient portals and booking pages, and widely deployed software components. The October 26 additions included a memory-corruption flaw in PHP (CVE-2026-109618) — the same family of web-server vulnerabilities we warned about when PHP flaws put practice websites and portals at risk. Recent weeks also brought actively exploited bugs in remote-access and firewall products from major vendors.

An abstract dental practice network with a red crack on the internet-facing remote-access gateway at the edge — The vulnerabilities attackers exploit most are on the edge: remote-access gateways, VPN appliances and the web servers behind a practice’s portals.

If your practice has a VPN for after-hours access, a firewall at the edge, or a website with any kind of login, the KEV catalog is describing your attack surface, not someone else’s data center.

From “known exploited” to a locked practice in days

The reason KEV listing deserves your attention is speed. Once a vulnerability is publicly confirmed as being exploited, criminal groups fold it into their toolkits within days — and healthcare is a favored target, with ransomware against the sector surging through 2026. The most common breach stories are not clever, bespoke hacks; they are an attacker scanning the internet for one of these known, already-exploited flaws on an unpatched edge device, walking in, and encrypting the practice.

A silver stopwatch and a blue calendar showing a few days, with a lock turning from blue to red — Once a flaw is confirmed as actively exploited, the window between disclosure and a ransomware attempt is measured in days, not months.

A KEV entry is effectively a countdown clock. The flaws on that list are the ones being sprayed across the internet looking for a practice that has not gotten to them yet.

How a dental practice can actually use it

You do not need a security team to put the KEV catalog to work. A practical routine looks like this. First, know what you expose: keep a short inventory of anything internet-facing (firewall, VPN or remote-access gateway, website, patient portal) and the core clinical software versions you run. Second, watch the list: subscribe to CISA’s free alerts so new KEV additions land in an inbox you check. Third, cross-reference: when a product you use appears on the KEV catalog, that patch jumps the queue ahead of everything else, regardless of its severity score. Fourth, set a deadline: give KEV-listed items a firm remediation window — the federal standard is roughly two weeks, and faster is better for anything at the network edge.

An orderly workflow matching a practice IT inventory against a blue reference list and fast-tracking a few flagged items — A practical routine: inventory what is exposed, match it against the KEV list, and fast-track the handful that appear there.

Finally, write it down, because this is also a compliance record: under PHIPA, demonstrating a reasonable, risk-based patching process matters, and “we prioritize vulnerabilities under active exploitation” is exactly that. If you already run a disciplined routine like our server backup, patch and access checklist, the KEV catalog simply tells you where to point it first.

You should not have to watch the list alone

The KEV catalog is powerful precisely because it is simple — but it only helps if someone is reading it against an accurate picture of your systems, week after week, and acting before the countdown runs out. That is the kind of quiet, continuous work that keeps a practice off the breach reports, and it is easy to let slide when you are running a clinic. If you are not certain which of your systems are internet-facing, whether your remote-access and firewall appliances are current, or how your practice would even know when a flaw you rely on lands on the KEV list, contact Compudent Systems for a vulnerability and patch-prioritization assessment. We will map your exposure, line it up against what is actually being exploited, and make sure the patches that matter most get done first.

Sources & further reading:

The Free Federal List That Tells Your Dental Practice What to Patch First: Making Sense of CISA’s KEV Catalog