Patch Management.

What is patch management?

A patch is a software change that fixes a problem, often a security flaw. Patch management is the work of handling those changes across an organization. NIST SP 800-40 says enterprise patch management is the process of identifying, prioritizing, acquiring, installing, and verifying the installation of patches, updates, and upgrades throughout an organization.

How does the patching process work?

The NIST definition lists the steps. First, an organization identifies which patches apply to its systems. Next, it prioritizes them, because not every patch is equally urgent. Then it acquires and installs them. Last, it verifies that the installation worked.

A simple illustration: a team learns that a program it uses has a security fix. It checks which computers run that program, decides how urgent the fix is, installs it, and then confirms the fix is in place.

Why does patch management matter?

NIST says preventive maintenance through enterprise patch management helps prevent compromises, data breaches, operational disruptions, and other adverse events. It also says patching is more important than ever because of the increasing reliance on technology.

NIST notes that there is often a divide between business or mission owners and security or technology managers about the value of patching. It describes patching as a cost of doing business and a necessary part of what organizations need to do to achieve their missions. It recommends creating an enterprise strategy to simplify and operationalize patching while also improving the reduction of risk.

How can teams decide what to patch first?

CISA keeps a catalog of known exploited vulnerabilities. A vulnerability is a weakness in software or hardware that an attacker can abuse. CISA describes this catalog as the authoritative source of vulnerabilities that have been exploited in the wild. It says organizations should use it as an input to their vulnerability management prioritization framework.

CISA also directs stakeholders to apply mitigations in accordance with vendor instructions. A vendor is the company that makes the product. For products where mitigations are unavailable, CISA recommends that stakeholders discontinue use of the product. CISA also says organizations are responsible for evaluating each asset’s internet exposure.

A fix does not always reach every branch of a product. When ISC fixed the BIND 9 flaw CVE-2026-94300 in October 2026, it listed no fixed release for the 9.18 line, which ISC lists as end of life. Our page on BIND 9 vulnerability fixed versions explains the move to a supported branch. One fix often closes several advisories at once. In November 2026 the Zero Day Initiative listed one release as the fix for three Foglight flaws, including the Quest Foglight deserialization flaw CVE-2026-92190.

Configuration can also change priority. Our Cisco ASA and FTD VPN DoS patch alert shows how an exploited flaw depends on both a release and exposed settings. The CVE-2026-76418 technical profile explains the tunnel-group conditions behind that patch decision.

Veeam’s 29 October Management Pack advisory includes a compatibility patch in its affected 9.x scope. Our Veeam Management Pack upgrade comparison separates that patch from the 13.1.0.334 security fix.

The update itself can be a risk window. The WordPress core upgrade race CVE-2026-119977 let unauthenticated attackers run code while a core upgrade was in progress.

A Critical-rated example is JetBrains CLion’s Safe Mode bypass, CVE-2026-123831.

How does patch management relate to nearby terms?

Patch management is one part of vulnerability management, which covers finding and ranking weaknesses more broadly. A zero-day vulnerability is a flaw that is known before a fix exists, so related terms are listed below for further reading.

Is patch management the same as vulnerability management?

No. Vulnerability management is the wider practice of finding and prioritizing weaknesses. Patch management is the process of getting fixes onto systems and checking that they are in place.

Is a patch the same as an update?

The NIST definition names patches, updates, and upgrades as separate items that the process covers. In everyday use, people often say patch for a fix and update for a newer version.