A vendor advisory applies to you only if you run an affected product and version, in a configuration that meets the stated preconditions. Read it in that order: product, version range, preconditions, fix or workaround, then your own record. Most advisories can be ruled in or out in about ten minutes.
Start with the affected versions
Find the version table first. It usually lists affected versions, fixed versions, and sometimes versions that are end of life and will not be fixed. Compare against what you actually run, not what you think you run. If you do not know the exact version, that is the first thing to fix.
Check the preconditions
Many advisories say a flaw needs a particular feature enabled, a certain network position, or a user action. Read these lines carefully. A bug in an optional module you never turned on is a different situation from a bug in the default path.
Preconditions are also where a high score can drop in practice. The CVSS specification describes the Base Score as intrinsic severity that stays constant across environments, while environmental metrics exist to refine it for a specific setup. The advisory score is written for nobody in particular.
Look at the fix and the workaround
Is a fixed version available now? If yes, the question becomes how fast you can test and ship it. If only a workaround exists, note what it costs and who owns it. If neither exists, note that too and set a date to look again.
Check for signs of exploitation
Advisories sometimes say the vendor is aware of exploitation. Compare with the CISA Known Exploited Vulnerabilities catalog, which CISA describes as the authoritative source of vulnerabilities exploited in the wild. A vendor statement or a catalog entry moves the item up your list.
Decide and record
Put one of four labels on the item: affected and fixing, affected with a workaround, not affected, or watching. Add the date, the version you checked, and your reason. A one line "not affected, we do not run the optional module, checked 19 October" is worth more later than a clean memory.
Common traps
Advisories name products by marketing name while your inventory uses package names. Bundled components carry the flaw inside another product. A hosted service may be fixed by the vendor with nothing for you to do, which the advisory will usually say.
Quick check
What if the advisory does not list my version?
Treat it as unknown, not safe. Check the vendor's version history or ask the vendor, and record that you asked.
Do I patch if I am not affected?
Not for this advisory. Keep normal update habits, and write down why it did not apply.
Sources
Last reviewed: 19 October 2026.
