Virtual patching is a security policy layer, such as a web application firewall rule, that blocks exploitation of a known vulnerability without changing the application's code. It helps when no vendor patch exists or testing will take too long. It does not fix the flaw and can be evaded, so it is a stopgap.
Definition
OWASP defines a virtual patch as a security policy enforcement layer which prevents the exploitation of a known vulnerability. The layer inspects traffic in transit, so malicious requests are stopped before they reach the application.
When it helps
OWASP lists situations where it fits:
- A vendor patch is unavailable or delayed.
- Patch testing and deployment take too long for the risk.
- Fixing custom code is too costly.
- The application is legacy, unsupported or outsourced.
- The system is mission critical and cannot go offline.
In a zero-day, the first and second apply most often.
Where it falls short
| Limit | Meaning |
|---|---|
| Not a fix | The flaw is still in the code |
| Evasion | Exploit-specific rules can often be bypassed with variations |
| Parsing gaps | Protection depends on the tool normalizing input as the server does |
| Maintenance | Allow-list rules are strong but hard to keep up to date on large sites |
| Coverage | Only covers traffic passing through the layer |
Deny-list rules are quick to write but easier to evade. Allow-list rules are stronger but need more effort.
How to deploy one well
- Learn the exploit conditions from the advisory.
- Find something essential to the attack that is abnormal for real traffic.
- Write the rule to avoid false positives first, because blocking real users is its own outage.
- Test with tools such as curl against a staging copy.
- Record it in change management, review it periodically, and remove it when the code fix is in.
Pre-authorizing virtual patches as a fast-track change, as OWASP suggests, saves time when an event starts. See standard, normal and emergency changes.
Not every flaw can be virtually patched
Flaws that are triggered by non-web protocols, by local access or by a supply chain compromise are not covered by a web rule. For those, use isolation, feature disablement or access restriction. Compare options in the patch or mitigate decision table.
Example
Suppose an advisory says a specific URL path accepts crafted input. A temporary rule that blocks requests to that path from untrusted networks, while the real fix is tested, is a virtual patch. When the code update ships, you remove the rule and note it in the change log.
Try it yourself
Click through it at your own pace, or open it full screen.
Check how a finding looks once exploitability is considered.
Quick check
Is virtual patching the same as patching?
No. It blocks known exploit patterns while the underlying code stays vulnerable. Apply the real fix when available.
Does a WAF rule protect internal traffic?
Only traffic that passes through it. Attacks that bypass the WAF, or originate inside, are not covered.
Sources
Last reviewed: 19 October 2026.
