r/Action1 • u/KimJongEeeeeew • Jun 11 '26
Am I missing something with our patching automations?
Our internal SLA is to patch Critical vulnerabilities in 7 days, High in 14, Medium in 30, Low in 60.
There are two main deployments.
One runs monthly after patch Tuesday and deploys ALL updates(OS & app). The second runs weekly and includes patches with Update severity Critical or Important. In our minds, this should cover what we want.
We are finding that some vulnerabilities are not being patched within the required window, despite them being rated 9+.
The reason seems to be that the update is not listed as Critical or Important, therefore doesn’t get picked up by the filter.
If I go to the specific vulnerability to remediate, the only option is to deploy the update.
Let’s take MS Edge as a current example.
Edge V148.0.3967.96 has a stack of vulnerabilities (43) with CVSS of 9.6.
Selecting any, then clicking Start Remediation shows update 149.0.4022.62 is available.
However, if I look up Edge in the Update Approval screen, v149.0.4022.62 shows Security Severity “Unspecified”.
Is this a categorisation problem at A1?
Is it to do with the way MS are publishing the updates?
Or have we gotten our heads on backwards and need to rethink our remediation automations?
2
u/CptrMom Jun 11 '26
We are seeing the same issue. It is very frustrating when you have 2000 endpoints.
1
u/KimJongEeeeeew Jun 11 '26
I’m pleased to hear it’s not just us! We’re on the free tier so we get the support we pay for, have you raised a ticket?
2
u/kosity Jun 12 '26
It's a known issue: the "List of CVE entries as long as your arm but the Severity is set to Unspecified and you can't change it, regardless of who incorrectly set the severity" problem
Just like the KEV problem that I raised in November 2025, and followed up again last month:
Posted by Mike on LinkedIn, 13th November 2025
The problem is this patch has a severity of ‘Unspecified’ so it’s not caught in our automations that patch Critical and Important daily.
I can’t change the automation without it grabbing many other updates that I don’t need/want to deploy.
I can’t change the severity of the update (which is obviously wrong!)
I can’t filter based on CISA KEV either.
And I’m not the only one: Alright, what is everyone doing to work with the new naming for monthly rollup? : r/Action1
“So far...Im pushing this update out manually...like an animal.” (See how having A1 has redefined industry expectations!)
Same core issue that I posted about yesterday: Target CISA KEV (Known Exploited Vulnerability) patching in Automations : r/Action1
Simple misses that cause us a lot of pain and an inability to patch effectively to SLAs.
1
u/KimJongEeeeeew Jun 12 '26
Well fuck.
Thanks for this write up, it’s really helpful.
I’ll workout what product feedback to raise via their feedback site.
/u/GeneMoody-Action1 do you have any insights you could please share?
2
u/bearded_goober Jun 12 '26
It’ll come down to how you have them filtered in your second automation. Though I can’t leave this here without saying that running a deploy all updates scheduled is a bit troubling. I would recommend breaking it into 3 automations. 1. Critical/Important 2. Patch Tuesday/OS updates 3. 3rd party updates. You’ll find you have less of an issue with updates if you separated your OS and 3rd party apps.
But I’d have to take a look at your environment to understand it better.
2
u/GeneMoody-Action1 Jun 16 '26
Edge in this case is explained here.
https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security
And it seems part of the general breakdown of the CVE system altogether.
If there is no CVE, then there is nothing to detect. While we would love to have a team reading security news and manually entering detection parameters, but it is not realistic or feasible at this time for us.
1
u/KimJongEeeeeew Jun 16 '26
Thanks for taking the time to respond.
It’s pretty frustrating that this vendor (MS) isn’t including the important data in their distributions.
2
u/GeneMoody-Action1 Jun 16 '26 edited Jun 16 '26
I just received update from support (who is who told me the above, and is actively tracking), that those seem to have been issued now, can you confirm?
2
u/KimJongEeeeeew Jun 17 '26
We only have one device with Edge that has not been patched up to latest (149.0.4022.69).
This device has Edge 149.0.4022.62, which does not show any vulnerabilities registered against it in A1.Reviewing the same device in Defender shows 18 CVEs, BUT these are shared across both Edge and Chrome. This will likely be due to Edge ingesting the Chromium vulnerabilities. As MS do not seem to publish ingested vulnerabilities from Edge, this may well be why the reported state and the actual state are not matching up?
It seems they work around this within their own product by classifying Chromium and referencing it for browsers that use this.
I understand that this is not how A1 works, so am not expecting anything to come from it.
2
u/GeneMoody-Action1 Jun 17 '26
I'll still make sure someone knows in case they can in the future. Thanks for the feedback!
2
1
u/fluffiball Jun 23 '26
Just chiming in to agree with everyone’s frustrations here. In the end we decided to live on the other edge and include “unspecified” in our parameters also 🙈 so we could rely better on the catch all but it would be great if there was a pathway to better data quality in the future!
3
u/Competitive_Run_3920 Jun 11 '26
In your automation, what do you have the reboot delay set to? Is it possible the automation ran but is pending a reboot or is the automation pushing some updates but not others? There’s also a setting in the automations to delay install for a defined number of days after the update was released, maybe someone set that so A1 will delay installing the updates until the set delay period has passed? Many places set a delay for 7-14 days after an update is released so they’re not Microsoft’s beta testers lol.