# What is Virtual Patching?

> Virtual patching is a compensating security measure that places an enforcement rule between an exploitable system and relevant requests or traffic, blocking or constraining known exploit paths while the underlying code or component remains unchanged.

- Canonical URL: https://yellowcube.eu/glossary/virtual-patching/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It is commonly implemented with a web application firewall, intrusion prevention system, reverse proxy, gateway, or host control when a permanent repair cannot be deployed immediately.

A useful virtual patch is based on the actual weakness and reachable attack path, tested against legitimate use, monitored for matches and side effects, and assigned an owner and expiry condition. It can reduce exposure during emergency remediation, vendor delays, maintenance windows, or legacy-system replacement.

### Key points

- **Good candidates:** Vulnerabilities whose exploit traffic or actions can be identified and constrained at an available enforcement point without unacceptable disruption.
- **Lifecycle:** Analyze the weakness, design and test the rule, deploy with rollback and monitoring, review bypasses and false matches, then remove or revise it after permanent remediation.
- **Evidence:** Record the affected assets and versions, protected paths, assumptions, test results, rule changes, match telemetry, exceptions, owner, and planned retirement date.
- **Important limitation:** Virtual patching does not repair defective code, remove the vulnerable component, or cover exploit paths the enforcement point cannot observe. Rules may be bypassed, overblock legitimate activity, or remain forgotten after systems change.

### Related terms

[Web application firewall (WAF)](<https://yellowcube.eu/glossary/web-application-firewall/>) · [Intrusion prevention system (IPS)](<https://yellowcube.eu/glossary/intrusion-prevention-system/>) · [Vulnerability management](<https://yellowcube.eu/glossary/vulnerability-management/>) · [Compensating control](<https://yellowcube.eu/glossary/compensating-control/>) · [Application security](<https://yellowcube.eu/glossary/application-security/>) · [Patch management](<https://yellowcube.eu/glossary/patch-management/>)

### Sources

[OWASP Virtual Patching Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Virtual_Patching_Cheat_Sheet.html) · [NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning](https://csrc.nist.gov/pubs/sp/800/40/r4/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.