The headline says 'critical zero-day, patch immediately'. Sometimes that is your emergency. Sometimes it is a product you do not run, on a version you do not have. A professional response starts with telling those two apart — fast.
By Technical AnshuManageEngine Endpoint CentralFor IT Admins
Watch the full video — ManageEngine threat detection and patching, shown live on the console
Zero-day means the vulnerability is known and possibly exploited before a fix exists — or the fix has only just landed. Endpoint Central has a dedicated Threats → Zero-day Vulnerabilities view for exactly this moment, including mitigation when no patch exists yet. This page is the workflow to run in the first hours, in order, without either panic or complacency.
Zero Day Triage — First Hour Checklist (example)
Product and version in the advisoryMatches our fleet?
Exploitation reported in the wildYes — act today
Patch available from vendorYes / No
If no patch — mitigation publishedScript / config change
Systems flagged in consoleAttention Required list
Example triage panel for illustration. Every row answered with evidence beats an opinion offered quickly.
1
Verify Before You Move — 20 Minutes That Save the Day
News coverage compresses and exaggerates. The advisory is the source of truth.
Read the vendor advisory and a trusted source such as CISA's Known Exploited Vulnerabilities list — confirm the exact product, versions and conditions
Check your own estate: does that product and version exist on your machines, and are the vulnerable conditions actually present?
If it does not affect you, say so in writing with the evidence — 'not applicable, here is why' is a complete and professional answer
If it does affect you, count exposure first: how many systems, which are internet-facing — that number drives everything next
2
Use the Console's Zero-Day View, Not Manual Hunting
Endpoint Central tracks zero-days as a first-class view because manual spreadsheet hunting is how machines get missed.
Open Threats → Zero-day Vulnerabilities — every affected managed computer is listed there
Cross-check Systems → Attention Required → Zero-day Found so no flagged machine is overlooked
Click Fix on the vulnerability — the console now branches by reality, not by hope
Note the numbers for your report: affected systems before action, and the plan for each
3
Two Branches — Patch Exists, or It Does Not
This is where zero-day response differs from normal patching: half the time there is no patch, and 'wait' is not a plan.
Patch available: the Fix action creates a deployment task — test it on the pilot machines immediately (hours, not the usual week), then deploy the same day to affected systems
No patch yet: the same Fix flow deploys ManageEngine's pre-built mitigation — a tested script or security configuration that reduces or closes the exposure as a workaround
Apply compensating controls meanwhile: restrict the affected feature, tighten firewall rules, or take the riskiest systems off the exposed path
Set an Automate Patch Deployment task for Critical Updates so the moment the real patch ships, it deploys under your policy without you watching the news
4
Communicate Like an Admin, Not a Headline
Management does not need adrenaline; they need three facts and a time.
Send the short version early: what it is, whether we are affected and how many systems, what is already done, what happens next and when
Separate confirmed facts from 'reported in the news' — label anything unverified as unverified
Update once more when the action completes, with the rescan numbers
Log the whole event in your change/incident record while it is fresh — dates, advisory ID, actions, results
Honest note: a mitigation is a seatbelt, not a repair. Until the vendor's real patch is deployed and verified by rescan, the vulnerability is managed — not closed. Keep the emergency task open, and the auto-deploy for the critical fix armed, until that rescan says otherwise.
Watch the Complete Process in the Video
Threat detection, vulnerability scanning and patch deployment in ManageEngine — every step shown live, in the video linked below.
There is no patch for the zero-day. Are we helpless until the vendor ships one?
No. Vendors and ManageEngine publish mitigations — configuration changes or scripts that block the known attack path. Endpoint Central can deploy those from the same Fix action. Mitigation plus monitoring plus an armed auto-deploy for the real patch is a strong position, not helplessness.
Should I patch the zero-day to all machines immediately, skipping the pilot ring?
Shorten the pilot, do not delete it. A rushed untested patch has broken more offices than most zero-days. Test on the pilot machines within hours, then deploy the same day — that is fast and still sane.
The news zero-day does not affect us. Do I still need to do anything?
Yes — document it. One short note with the advisory, the affected versions, and why your estate is outside them. When the question comes again in the audit or the next headline, the answer already exists.
This guide is based on the ManageEngine threat detection and patching video by Technical Anshu • Stuck on a step? Ask in the video comments — answers happen there.