# Vulnerability Report Walkthrough: Missing Security Patch

North Star Security

This is a simulated example for learning and portfolio practice. It is not from a real customer environment.

## Scenario

A vulnerability scan reports that a demo web server is missing a security update for an exposed service.

**Finding:** Missing security update on web service  
**Affected asset:** demo-web-01  
**Observed address:** 198.51.100.20  
**Severity:** High  
**Status:** Validated; remediation recommended  

## Weak version

> The scanner found a high vulnerability. Patch it.

That is not enough. A useful report explains scope, evidence, impact, and the next step.

## Better finding summary

The demo-web-01 server is running an outdated web service version with a known security update available. The finding was identified by a vulnerability scan and should be validated against the asset inventory and package version. Because the service is reachable in the scenario, remediation should be prioritized, followed by a retest to confirm the updated version is installed.

## Evidence reviewed

- Vulnerability scan result and plugin/check name
- Affected asset hostname and observed address
- Detected service and version
- Vendor/security advisory reference
- Asset exposure context
- Retest method

## Technical detail

The scanner reported that the detected service version is older than the fixed version listed in the advisory. The report should not rely only on severity. The analyst should confirm the running version, affected package, and whether the asset is actually in scope.

## Business impact

If the vulnerable service is reachable by unauthorized users, an attacker may be able to exploit the weakness depending on the specific vulnerability and configuration. The practical business risk is unauthorized access, service disruption, data exposure, or use of the affected system as a foothold.

## Recommendation

1. Confirm the affected package and running version on demo-web-01.
2. Apply the vendor-supported security update or move to a supported version.
3. Restart the affected service if required.
4. Retest the asset after remediation.
5. Document the updated version, date, and evidence screenshot/export.

## Retest plan

**Retest method:** Run the same vulnerability check after patching and confirm the detected version is no longer vulnerable.  
**Passing evidence:** Updated package version, clean scan result, or advisory-specific validation output.  
**Remaining gap if partial:** Document unsupported dependencies, planned maintenance window, or compensating control.

## Final report paragraph

A vulnerability scan identified that demo-web-01 is running a web service version with a security update available. The affected service should be validated against the asset inventory and updated to the supported fixed version. Because the service is reachable in this scenario, remediation should be prioritized and followed by a retest with evidence showing the updated version or a clean scan result.

## Resume bullet version

Validated a simulated high-severity vulnerability finding against affected asset details, documented evidence and business impact, and wrote a remediation and retest plan for a missing security update.

## North Star standard

A scanner result is not the report. The report is your explanation of what the result means, how you validated it, and what action should happen next.