Start with exposure, not panic. Identify whether affected products and versions exist in your environment, whether they are reachable, and whether vulnerable features are enabled. Keep a record of what you have verified and what is still unknown.
Use vendor advisories and the CISA Known Exploited Vulnerabilities catalog as primary references. A severity score alone does not tell you whether exploitation is occurring or whether your specific deployment is affected.
Assign an incident owner. If a patch is unavailable, evaluate vendor-recommended mitigations and isolation measures under change control. Preserve evidence and involve incident response if exploitation is suspected.
After applying a fix, verify the installed version and rescan where appropriate. Communicate the remaining uncertainty and document the action taken. This general guide is not incident-specific advice.