What Is the Best Compensating Control for a Critical Unpatched Vulnerability?

Quick Answer

Applying a virtual patch via a WAF is the best compensating control here because it directly addresses the core constraint in the scenario: the vulnerability is critical, with a CVSS score of 9.8, but the underlying server itself can't be patched due to vendor dependency, meaning the fix has to happen somewhere other than the vulnerable software itself. A WAF sits in front of the web server and inspects incoming HTTP/HTTPS traffic, and a virtual patch works by writing a rule that specifically recognizes and blocks the traffic pattern an attacker would need to send to exploit that particular vulnerability, effectively closing the door at the network edge rather than inside the application code the vendor controls. This is the defining idea behind a compensating control in general: when the primary fix, patching the actual flaw, isn't available or isn't currently possible, you find another control that reduces the same risk to an acceptable level without touching the thing you can't change. Because the WAF operates independently of the server's own software, the server keeps running and serving legitimate traffic exactly as before, while the WAF absorbs the burden of filtering out exploitation attempts targeting that specific flaw. This keeps the system both operational and protected until a real patch eventually becomes available from the vendor. When a question describes a critical vulnerability that can't be patched directly, look for an answer that intercepts and blocks exploitation at a different layer, such as network or application-layer filtering, rather than one that tries to modify the unpatchable system itself.