Question

A SOC analyst reviews a critical unpatched vulnerability (CVSS 9.1) on a legacy manufacturing control server. The vendor no longer supports the operating system, and applying the upstream OS patch would break the proprietary application that must remain in production. What is the most appropriate patching recommendation for this asset?

Accepted Answer

Isolate the server behind network segmentation and apply compensating controls until a supported migration path is available

Answer

Immediately apply the upstream OS patch during the next maintenance window regardless of application impact

Answer

Accept the risk with no action since no vendor patch exists for the application

Answer

Uninstall the proprietary application so the OS can be patched normally