Or do I have to change the software at all ??? can I get by with an operational workaround or maybe virtual patching with a WAF?The decisions that need to be made are the same, whether the bug is a reliability problem or a functional defect or a security vulnerability.