A scan report returned multiple vulnerabilities affecting several production servers that are mission critical. Attempts to apply the patches in the development environment have caused the servers to

Upgrading the affected software is effectively the same as patching and has already been demonstrated to crash the servers in the development environment, making this option unsafe for production.

While informing management of risks is a good practice and may be part of the process, it is not an actionable remediation step and does not reduce the actual vulnerability exposure on the servers.

Compensating controls are alternative security measures implemented when the primary remediation (patching) is not feasible without causing harm, such as server crashes in mission-critical environments. These controls - such as network segmentation, WAF rules, IDS/IPS signatures, or enhanced monitoring - reduce the attack surface and likelihood of exploitation without requiring the destabilizing patch. This approach balances operational continuity with acceptable risk reduction until a safe patch path is identified.

Removing the affected software from mission-critical production servers would likely cause significant business disruption or outages, making it an impractical and disproportionate response to the vulnerability.