Schildmark DeutschFrançais Talk to sales
Menu

Platform

Patching that runs itself, and proves it

The analyst finds the vulnerable package and proposes the fix. With unattended approval on, routine fixes go out without anyone stepping in: rehearsed on the machine first, installed in its maintenance window, and counted as done only when the vulnerability is confirmed fixed.

From question to verified fix

Ask the analyst what is exploitable, or open an alert. It names the package, the machines and the fixed version in plain words, and proposes the fix. Turn on unattended approval and routine fixes go out on their own: rehearsed first, verified after. Critical machines still wait for two people.

You askedIs anything on my machines exploitable right now?
Read as Vulnerabilitiesall machinesknown exploited first

Google Chrome on 14 Windows laptops has a vulnerability that attackers are using.

CVE-2025-6554 is a type confusion in V8, Chrome’s JavaScript engine: a crafted web page can read and write memory it should not reach. It was exploited before the fix was out and is on CISA’s list of known exploited vulnerabilities. Chrome 138.0.7204.96 fixes it; update all 14 laptops.

CVE
CVE-2025-6554
Severity
High
Known exploited
Yes, CISA KEV
Machines
14 Windows laptops
Fixed in
138.0.7204.96
Channel
winget (pilot)
Proposed fixUpdate Google Chrome on 14 machines

137.0.7151.120 138.0.7204.96

Unattended approval: on for laptops, low risk

  1. Verify
  2. Plan
  3. Dry run
  4. Approved automatically by policy
  5. Installed
  6. Verified
Remediatedthe vulnerability scan confirms the fix 0 machines exposed (14 before)
High CVE-2024-6387 (regreSSHion) confirmed on web-01Vulnerability check 3 machines, just now
You askedWhat is this, and what do I do about it?
Read as Alertweb-01vulnerability check

OpenSSH on 3 Ubuntu servers can be attacked without a password.

CVE-2024-6387, known as regreSSHion, is a race condition in a signal handler of sshd. On glibc-based Linux, an attacker who can reach the SSH port may run code as root without signing in. OpenSSH 8.5p1 to 9.7p1 are affected; on Ubuntu 22.04 the fix is openssh-server 1:8.9p1-3ubuntu0.10.

CVE
CVE-2024-6387
Severity
High
Machines
web-01, web-02, app-03
Affected
OpenSSH 8.5p1–9.7p1
Fixed in
1:8.9p1-3ubuntu0.10
Channel
apt
Proposed fixUpdate openssh-server on 3 machines

openssh-server 1:8.9p1-3ubuntu0.10

Unattended approval: on for web servers, low risk

  1. Verify
  2. Plan
  3. Dry run
  4. Approved automatically by policy
  5. Installed
  6. Verified
Remediatedthe vulnerability scan confirms the fix 0 machines exposed (3 before)
You askedWhich Macs need attention?
Read as VulnerabilitiesmacOSfixable first

Two Macs run a Homebrew curl with a heap overflow.

CVE-2023-38545 is a heap buffer overflow in curl’s SOCKS5 proxy handshake, triggered by a very long host name. curl 7.69.0 to 8.3.0 are affected and 8.4.0 fixes it; Schildmark can update the Homebrew package. hr-lap-2 also waits for a macOS update: that one is installed on the Mac itself.

CVE
CVE-2023-38545
Machines
hr-lap-2, design-mac-1
Installed
curl 8.3.0 (Homebrew)
Fixed in
8.4.0
Channel
Homebrew (pilot)
macOS update
Detected; install on the Mac
Proposed fixUpdate curl on 2 machines

8.3.0 8.4.0

Unattended approval: on for laptops, low risk

  1. Verify
  2. Plan
  3. Dry run
  4. Approved automatically by policy
  5. Installed
  6. Verified
Remediatedthe vulnerability scan confirms the fix 0 machines exposed (2 before)

Demo with sample data. CVE details are real. Windows and macOS patching are in pilot; macOS system updates are detected and explained, then installed on the Mac itself.

Every fix takes the same six steps

Whether a person approves it or the policy does, nothing is skipped. Unattended approval applies only to environments you list, to machines that are not high or critical, and to plans with nothing restricted; such jobs say Approved automatically by policy.

  1. Verify

    The job starts from a confirmed finding and reads the machine’s current state.

  2. Plan

    The exact package version, or Windows KB, that fixes it is chosen.

  3. Dry run

    The install is rehearsed on the machine without changing it.

  4. Approve

    A person, or the unattended-approval policy you turned on. Critical machines need two different people.

  5. Install

    In the machine’s maintenance window, and only with restarts it allows.

  6. Verify the fix

    Done only when the version is in place and the vulnerability is confirmed fixed.

The Patching page: a list of machines that need action, and the selected machine web-01 with one patch waiting for approval, four available fixes with their versions and CVEs, and its history.
Patching, one machine selected.Sample data
  1. The fleet in one sentence. What waits for approval, what is running, how many fixes were verified in 30 days.
  2. Machines that need you first. Each says in a few words where it stands.
  3. Waiting on you. Rehearsed jobs that need a decision.
  4. Exploited. Fixes for vulnerabilities known to be exploited are marked.
  5. History. Including fixes made outside Schildmark, such as an automatic update overnight.
A finished patch job: libssh-4 updated on web-01, every step from planned to fix verified ticked, and two of two vulnerabilities confirmed fixed.
A job, verified.Sample data

Installed is not the same as fixed

A job ends Remediated only when the installed version is at least the target, the machine’s software list shows it, and verification reports every fixable vulnerability of the job as fixed. Otherwise it says Not verified or Reboot required, never done.

Safety you set per machine

Maintenance window
Scheduled jobs wait for it; restarts outside it are refused.
Restarts
Allowed or not. Without permission, no patch and no person can restart the machine.
Criticality
Critical machines need two approvers and are never approved unattended.
Deny list
Packages such as container runtimes need escalated approval.
Rollouts
One package across rings of machines; the next ring starts only when the one before has succeeded.
Accepted risks
When a fix cannot be installed, record the owner, the reason and an expiry instead.

What it installs from

ChannelStatus
apt, dnf (Linux)Available
Windows Update KBsPilot
winget, pipPilot
Homebrew (macOS)Pilot
macOS system updates, other third-party applicationsInstall on the machine; the console shows them as fixed when they are

Patching uses the same Schildmark Agent, installed with --patching. It connects out only, signs every request, and runs only jobs your console signed, from a fixed list of actions. There is no shell and no “run command”.

Talk to sales

Tell us about your machines, your firewalls and the audit you are preparing for. We answer within one working day.

Talk to salessales@schildmark.com