how to handle a CVE with no patch available

TL;DR

No patch means you buy time, not that you do nothing. Confirm you are actually affected, put mitigations in front of the vulnerable path, and watch the advisory on a schedule. When the patch lands, you patch like normal. The mitigation is a bridge, not a fix.

how to handle a CVE with no patch available

Use this when

• An advisory is published with no fixed version yet
• The vendor has acknowledged the issue but hasnt shipped a fix
• You are pinned to an unpatched branch and the fix only exists upstream
• A zero-day is circulating and the patch is still being written

Not for

• CVEs where a patch already exists (patch first, always)
• Deciding whether the CVE is a false positive (different skill)
• Long-term exceptions after you have decided never to patch (thats risk acceptance)

Steps

1. Confirm you are actually affected.

Read the advisorys affected versions and trigger conditions, check your lockfile and your config. A no-patch CVE you are not exposed to needs nothing but a note.

Expected: a written affected or not affected verdict per service.

2. Rate the urgency honestly.

Public exploit plus internet-facing equals urgent. No public exploit plus internal-only equals monitor. Write the rating down so the response matches the risk instead of the panic level.

Expected: a one-line urgency rating everyone can see.

3. Deploy a mitigation at the vulnerable path.

Pick the cheapest effective barrier: a WAF rule blocking the exploit pattern, disabling the vulnerable feature or endpoint, restricting network access to the affected service, or input validation in front of the vulnerable code. Layer two if the risk is high.

Expected: the exploit path is unreachable or sharply narrowed, with the mitigation documented.

4. Put the advisory on a watch schedule.

Subscribe to the advisory feed, the vendors security list, or your scanners new-advisory alerts. Check weekly at minimum, daily for high-urgency items.

Expected: you hear about the patch within a day of its release.

5. Log it as a tracked exception.

Record the CVE, the affected assets, the mitigations in place, the watch schedule, and an owner. This is a known gap, not an ignored one.

Expected: one exception entry with an owner and a review date.

6. Patch the moment the fix ships.

When a fixed version appears, treat it as a normal priority patch: upgrade, verify, close the exception.

Expected: exception closed with the fixed version and scanner evidence.

Variant phrasings

CVE with no fix, what do I do

Mitigate the vulnerable path, watch the advisory, track it as an exception, patch when the fix lands. In that order.

Vendor hasnt patched yet and we are exposed

Push the vendor for a timeline while your mitigation holds. Escalate the urgency rating if an exploit goes public.

How long can we wait for a patch

As long as the mitigation holds and the risk stays acceptable. Re-rate urgency weekly, a new public exploit changes the answer.

Why it happens

Fixes take time: the vendor has to reproduce, patch, test, and release, and for open source projects that can be one tired maintainer. Meanwhile the advisory is public, so attackers know the flaw before you have the fix. The mitigation window is inherently adversarial, which is why the barrier goes up first and the waiting happens behind it.

Edge cases

• No mitigation possible: if the vulnerable path cant be blocked without breaking the product, your options are accept the risk in writing or take the service down. Escalate, dont quietly hope.
• Vendor never responds: consider replacing the dependency. A dead project with a live CVE is a permanent liability.
• Exploit goes public while you wait: re-rate to urgent, tighten or add mitigations, and consider emergency measures like taking the feature offline.
• Patch ships but breaks your build: deploy the mitigation as the primary defense and schedule the patch with a fix for the breakage. Dont leave the window open while you debug.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstS8V-s3bY4DDtm8MxHEdxg