#romcom

Analysis · May 20, 2026 · Colten Anderson

Known exploited, no patch: what to do in the weeks before a fix exists

When Microsoft disclosed CVE-2023-36884, it was already being used by a Russian group against governments, and there was no patch for weeks. Only mitigations. That scenario is more common than a patch-centric process assumes, and mitigations are the plan, not a consolation prize.