Direct answer
Read the vendor's current advisory and compare its affected versions and prerequisites with the deployed component and configuration. Record the evidence and remaining uncertainty; a product name match alone does not prove an installation is affected.
Capture the advisory
Record the advisory identifier, publication or revision date, affected versions, fixed versions and relevant prerequisites. Vendor guidance can change as investigation continues, so retain the source and review date rather than relying on an old copied summary.
Reference: NIST SP 800-40 Rev. 4: Enterprise Patch Management Planning.
Identify actual deployment
Check the running artifact, version and enabled feature with the application owner. A package may exist in source control but not in a given deployment, or a running container may lag behind the manifest. Record unknown instances and offline devices.
- Compare the exact product and version.
- Check the stated configuration and exposure prerequisites.
- Identify the authoritative source for deployed state.
Make a risk decision
Combine applicability with reachability, business impact and current threat information. If a condition cannot be verified safely, keep the finding unconfirmed and assign further investigation. Where patching is delayed, document a temporary mitigation and review date.
Reference: NIST SP 800-40 Rev. 4: Enterprise Patch Management Planning.
Verify the response
After a change, verify the deployed version and relevant behavior, then repeat the agreed security check. Record exceptions and systems that remain unavailable. A successful build does not show that every production instance received the update.
Assessment limits
Advisories and asset data can be incomplete or updated. Version and configuration checks cannot independently prove exploitation or rule out all vulnerabilities.
Frequently asked questions
Is every installation of a named product affected?
Not necessarily. Check the exact version and conditions in the vendor advisory against the actual deployment.
What if the deployed version is unknown?
Treat applicability as unresolved and assign an owner to establish the effective state.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.