What is Virtual Patching?
Virtual Patching is a security technique that blocks exploitation of a known vulnerability at the network or application layer without modifying the vulnerable system itself. It is used when a vendor patch is unavailable, when patching would cause downtime, or when legacy systems cannot be updated.
What it is
Virtual patching intercepts malicious traffic before it reaches a vulnerable system. Instead of fixing the flaw in the software or firmware, a control sitting in front of the system detects and drops requests that match the known exploit pattern.
The control can be an intrusion prevention system (IPS), a web application firewall (WAF), a next-generation firewall, or a DNS security layer. The vulnerable system never sees the malicious payload.
A virtual patch is typically written as a detection rule or signature. Security teams write the rule as soon as a CVE is published, often days or weeks before the vendor ships a fix.
Why it matters
Patching takes time. Vendors must test fixes. Operations teams must schedule maintenance windows. Some systems, such as industrial controllers or embedded devices, cannot be patched at all without replacing hardware.
During that gap, attackers actively scan for and exploit unpatched systems. Virtual patching closes the exposure window without touching the production system.
It is also used to protect end-of-life software that will never receive an official patch.
How tools address it
Intrusion Detection and Prevention Systems (IDPS) are the most common delivery mechanism. They inspect network traffic in line and drop packets that match exploit signatures for specific CVEs.
Next-generation firewalls apply similar logic at the perimeter. WAFs apply it to HTTP traffic specifically. DNS security tools can block command-and-control callbacks that follow a successful exploit, limiting damage even if the initial payload lands.
Tools such as network security agents running on the host can also apply virtual patches at the OS or process level, blocking syscalls or file operations associated with a known exploit.
Common confusions
Virtual patching is not a permanent fix. It reduces risk while a real patch is prepared and tested. The underlying vulnerability still exists. If the blocking rule is bypassed or misconfigured, the system remains exposed.