Patch immediately or isolate the system when a vulnerability is actively exploited, reachable by likely attackers, and capable of meaningful impact. A numeric severity score alone cannot define the deadline. Prioritize using exploit evidence, asset exposure, privileges gained, data and business impact, available mitigations, and confidence in the asset inventory.
Questions that determine urgency
- Is exploitation confirmed in the wild?
- Is the asset internet-facing or reachable from a compromised user network?
- Does exploitation require authentication or user action?
- What privileges and persistence can an attacker gain?
- Is exploit code reliable and widely available?
- Is the system critical, regulated, or a trust anchor?
- Can exposure be removed while testing the patch?
- Are logs available to determine whether exploitation already occurred?
Patch and investigate in parallel
When exploitation is active, patching closes a door but does not remove an attacker who entered yesterday. Preserve relevant evidence, hunt for compromise, rotate exposed credentials, and check persistence while remediation proceeds.
When patching cannot happen immediately
Disable the affected feature, restrict network access, place the service behind stronger controls, increase monitoring, or take the asset offline. Record the owner, expiry, and validation of every temporary mitigation. “Accepted risk” without a date becomes permanent exposure.
Build an emergency process
Maintain a current asset inventory, preapproved outage authority, test environments, rollback plans, vendor contacts, and alternate service procedures. Measure time from disclosure to identification, mitigation, patch, and verification—not merely ticket closure.
The bottom line
The right deadline is risk-driven. Active exploitation plus reachable critical systems demands hours, not a monthly cycle. Use severity as one input, and verify that the fix reached every affected instance.
