<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-endpoint-patch-management
description: >-
  Deploy and manage endpoint patching workflows using WSUS, SCCM/MECM,
  and Linux package managers. Covers vulnerability-driven prioritization,
  patch testing, staged deployment, compliance tracking, and rollback
  procedures.
domain: cybersecurity
subdomain: endpoint-security
tags:
  - patch-management
  - wsus
  - sccm
  - vulnerability-management
  - compliance
  - cisa-kev
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack:
    - T1190
    - T1203
    - T1068
---

# Implementing Endpoint Patch Management

## Overview

Patch management reduces the attack surface by remediating known vulnerabilities
before exploitation. Effective patching prioritizes using CISA KEV (Known
Exploited Vulnerabilities), EPSS (Exploit Prediction Scoring System), and CVSS
scores. Staged deployment minimizes operational disruption while maintaining
security posture.

## Prerequisites

| Requirement | Purpose |
|---|---|
| WSUS | Windows Server Update Services for Windows patching |
| SCCM/MECM | Microsoft Endpoint Configuration Manager |
| apt/dnf/yum | Linux package manager for OS patching |
| CISA KEV feed | Known exploited vulnerabilities catalog |

## Workflow

1. **Inventory assets** — Enumerate all endpoints and their current patch levels
2. **Identify missing patches** — Scan endpoints for missing security updates
3. **Prioritize patches** — CISA KEV first, then EPSS > 0.5, then Critical CVSS
4. **Test patches** — Deploy to test group and monitor for 48h
5. **Stage deployment** — Roll out to production in waves (10% → 50% → 100%)
6. **Verify installation** — Confirm patches applied via `Get-HotFix` or package queries
7. **Track compliance** — Dashboard showing patch compliance by group and SLA
8. **Rollback if needed** — `wusa /uninstall` or `apt rollback` for problematic patches

## Key Commands

```powershell
# WSUS — Approve update for computer group
Approve-WsusUpdate -Update (Get-WsusUpdate -UpdateId <id>) -Action Install -TargetGroupName "Production"

# Check installed hotfixes
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 20

# Check pending Windows updates
Get-WindowsUpdate -MicrosoftUpdate | Where-Object { $_.IsInstalled -eq $false }

# Force Windows Update scan
usoclient StartScan

# Linux — Check available security updates
apt list --upgradable 2>/dev/null | grep -i security
dnf updateinfo list security

# Linux — Apply security updates only
apt-get upgrade -s | grep -i security    # dry run
dnf update --security -y

# Rollback Windows update
wusa /uninstall /kb:5012345 /quiet /norestart

# SCCM compliance report
Get-CMSoftwareUpdate -IsDeployed $true | Select-Object LocalizedDisplayName,PercentCompliant
```

## Verification

| Check | Method |
|---|---|
| Patches deployed | `Get-HotFix` shows target KB installed |
| Compliance met | ≥95% of critical patches within SLA |
| CISA KEV addressed | All KEV entries patched within 14 days |
| No regressions | Test group reports no service disruption after 48h |
| Rollback tested | Rollback procedure documented and validated |

## References

- [CISA Known Exploited Vulnerabilities](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [EPSS — Exploit Prediction Scoring](https://www.first.org/epss/)
- [WSUS Documentation](https://learn.microsoft.com/en-us/windows-server/administration/windows-server-update-services/)

---
v1.0 | Validated: 2026-03-18
