Repository navigation

Patch Management and Deployments

Jump to bottom

Tyler Hatfield edited this page Nov 6, 2026 · 2 revisions

Patch Management, CVE Tracking & Deployments

Vitrine RMM unifies Windows Update orchestration, NVD CVE vulnerability scoring, OEM driver catalogs, and third-party application patching.

1. OS & Third-Party Patch Management

Fleet Patch Scan (POST /api/patches/scan): Triggers an immediate update discovery scan across online endpoints.
Single & Bulk Approvals (POST /api/patches/:id/approve & POST /api/patches/approve-bulk): Approve individual KBs or bulk-approve all pending updates within a category, with configurable canary deferral windows.
DISM / WUSA Patch Rollback (POST /api/patches/:id/rollback): One-click uninstallation and rollback of problematic updates.

2. Software Inventory & CVE Vulnerability Remediation

CVE & CVSS v3.1 Scoring (GET /api/devices/:id/software): Installed software packages are correlated against NVD CVE records, displaying CVSS v3.1 severity badges and CVE identifiers.
One-Click Auto-Remediation (POST /api/devices/:id/software/:softId/upgrade): Vulnerable applications supported by Winget/Apt can be upgraded in one click from the Software & CVEs tab, automatically clearing the CVE flag and logging the upgrade.

3. OEM Hardware Catalogs & Tray Reboot Governance

OEM Catalog Integration: Synchronizes with Dell Command | Update (DCU), Lenovo Commercial Vantage, and HP Image Assistant (HPIA) for BIOS and chipset firmware alignment.
Tray Snooze & Forced Countdown HUD: Governed by the active policy's max_snooze_hours and final_countdown_sec, giving end-users predictable snooze windows before displaying a non-intrusive bottom-left countdown timer.