A vulnerability has been found – take it through to a verified fix

1. Check whether you are affected

1. Identify the exact product and running version in the system's own administration interface. Include additional nodes, containers and test environments.
2. Read the vendor's advisory and compare versions, enabled features and affected operating systems. A matching product name is not enough.
3. Ask the operations provider for a clear answer if you lack access. Record the product, version, date and responsible person in the ticket.

2. Decide how urgent it is

CISA recommends prioritising internet-facing systems and known exploited vulnerabilities. Also consider how the business depends on the system. The CVSS score alone does not determine the order. [1]

3. Make the change recoverable

1. Check the current backup and how to restore data and configuration. For businesses, assign an owner and a maintenance window.
2. Choose a supported fixed version and read the upgrade requirements. A major version upgrade may require additional steps.
3. If no patch is available, use only a temporary restriction explicitly supported by the vendor and set a date to check again.

4. Update and verify

• Install the fix according to the vendor's instructions and restart if required.
• Check the version or package information in the running service.
• Test sign-in and the most important business function from an ordinary client.
• Record the fixed version, test results and any remaining actions.

Your checkmarks are stored only in this browser.

If the test fails

Stop further rollout. Collect the error code and logs, use the prepared recovery path if necessary and involve product support. Do not guess between several major changes. The workflow above is our practical recommendation; version-specific installation steps belong in the vendor's instructions.