> For the complete documentation index, see [llms.txt](https://pnpt.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pnpt.adot8.com/external-pentest-playbook/common-pentest-findings/insufficient-patching.md).

# Insufficient Patching

## Overview

The issue with most organizations isn't **Insufficient Patching** but rather **Weak/Breached Password.** However this doesn't mean that there aren't patching issues out there. It can range from out of date software to something more significant like **RCE** on an application or system.

{% hint style="info" %}
Check the versions of applications and software you come across in the engagement to make sure they're all up to date
{% endhint %}

## Example 1

<figure><img src="/files/fAz5WbZmq8H30MXY9iO5" alt=""><figcaption><p>Vulnerable server hosting Netscale</p></figcaption></figure>

<figure><img src="/files/6jRYjYFX4lg2nfQRBaUg" alt=""><figcaption><p>Scanner flagging as vulnerable</p></figcaption></figure>

<figure><img src="/files/7GWAweYJf6xxeT9zFUag" alt=""><figcaption><p>More evidence and Remediation</p></figcaption></figure>

## Example 2

<figure><img src="/files/ddKQ8IHh47IODnG4wgiC" alt=""><figcaption><p>Simple PHP server that is out of date. In risk section CYA language is used</p></figcaption></figure>

<figure><img src="/files/87agisvW5jVFI6tGStut" alt=""><figcaption><p>Evidence and Remediation</p></figcaption></figure>