×
×
×
×

Patch Issues

Last Updated On: 12 Oct 2026|
28 minutes read |

In some cases, a vulnerability, patch, or missing-patch state may not appear as expected in Patch Manager Plus even though it is visible in another scanner or was recently installed on the endpoint.

This does not always indicate a product issue. In many cases, the difference is caused by patch database sync timing, patch scan timing, applicability rules, selected patch categories, or supersedence.

Note

Depending on your product version, some menus may appear as Patch Mgmt or Threats & Patches. The paths below reflect the official product documentation terminology. If Threats & Patches is not available, navigate to Patches → Update Now.

Common Scenarios

You may see one of the following:

  • a CVE is visible in another scanner, but not in Endpoint Central
  • a patch is installed on the endpoint, but still appears as missing
  • a patch is expected, but appears as Not Applicable
  • a third-party patch is not visible in the expected view
  • the patch is visible in one view, but not in another
  • the endpoint was scanned, but the console state still seems outdated
  • the vulnerability appears for some time and disappears after a later sync or scan
  • an approved patch is not selected by an Automated Patch Deployment task
  • an APD task shows Patching Completed but installs no patches
  • the vulnerability and missing-patch severity counts do not match
  • a deployment contains more Not Applicable results than the earlier scan showed as missing

Before Assuming the Patch or CVE Is Missing

1. Confirm the Exact Identifier

Before troubleshooting, confirm exactly what you are checking:

  • CVE ID
  • Patch ID
  • KB number
  • application name and version
  • endpoint name

This helps avoid checking the wrong update, a superseded update, or a different product version.

To correlate a CVE with updates applicable to managed endpoints, filter Missing Patches by the CVE ID, then compare the affected systems and available patches.

To locate a vendor KB number, go to Patch Mgmt → Patches → Supported Patches and search the Patch Description field for the complete KB number. The result provides the corresponding Endpoint Central Patch ID and Bulletin ID. A vendor KB number does not match the Patch ID or Bulletin ID fields.

The Patch ID field requires the complete numeric ID. If the complete ID is unavailable or returns no result, search by Patch Description instead of entering a partial Patch ID.

2. Verify That Patch Database Sync Has Completed

Navigate to:

Threats & Patches -> Settings -> Patch Database Settings

Patch and vulnerability visibility depend on the latest patch metadata being available in the product. If Patch DB Sync has not completed successfully, the latest patch or vulnerability information may not yet be reflected in the console.

Refer to Patch Database Settings. If a manual sync does not complete in an open network, follow Patch Database sync failure in an open network.

Check the following:

  • whether the latest database sync completed successfully
  • whether the required patch categories are enabled
  • whether superseded patch settings match your environment

3. Confirm That the Endpoint Has Completed a Fresh Patch Scan

Navigate to:

Patch Mgmt -> Systems -> Scan Systems

Even if the server has the latest patch metadata, the endpoint must still report its latest state through a patch scan. If a patch was installed manually outside Patch Manager Plus, it can continue to appear as missing until a fresh patch scan reports the endpoint's current state to the server.

Verify that:

  • the endpoint is in communication
  • the latest scan completed successfully
  • the scan happened after the latest Patch DB Sync or remediation action

Refer to Scan Systems for Vulnerability and Patch Scan.

You can also trigger a manual scan from the endpoint using: Agent Tray Icon -> Scan -> Initiate Patch Scan.

A patch installed manually, through Windows Update, or through another tool can continue to appear as missing until the next successful patch scan reports the endpoint's updated state.

4. Check Whether the Patch Is Actually Applicable to the Endpoint

A patch may not appear as expected if it is:

  • not applicable to the installed OS or application version
  • superseded by a newer patch
  • optional and not enabled in patch settings
  • unsupported for that platform
  • not relevant to the installed architecture, language, or edition

Always confirm the endpoint OS version, application version, edition, and architecture before concluding that a patch is missing.

Microsoft can publish different KB numbers for the same monthly release across Windows versions. Compare the KB's supported operating system with the endpoint OS before treating a different KB number as a mismatch.

5. Verify Whether the Patch Category Is Enabled

Navigate to:

Threats & Patches -> Settings -> Patch Database Settings

If a patch category is not enabled, the expected patch may not be shown in the views you are checking.

This is especially important for:

  • optional updates
  • third-party applications
  • specific patch families that are not enabled by default in your environment

For an Automated Patch Deployment task, also verify the task's own update-type and severity selections. A patch can be enabled globally and approved but still be excluded when its type, such as Optional Updates, or its severity is not selected in that APD task.

6. Compare the Correct Patch Views

A patch may appear differently across views depending on its current state. Do not rely on only one view when checking patch visibility.

Use the following paths:

  • Patch Mgmt -> Patches -> Missing Patches
  • Patch Mgmt -> Patches -> Applicable Patches
  • Patch Mgmt -> Patches -> Installed Patches

Inside these views, compare the available sub-views such as:

  • Patch View
  • Computer View
  • Detailed View

7. Check the Vulnerabilities View

Navigate to:

Threats -> Vulnerabilities

This view shows vulnerabilities detected across endpoints and provides columns such as:

  • CVE ID
  • Affected Systems
  • Patch Availability
  • Remediation Method
  • Patch ID
  • Patch Name

By reviewing this page, you can verify whether the issue is:

  • a vulnerability with a deployable patch
  • a vulnerability with only a manual workaround
  • a vulnerability with no fix currently available
  • a visibility mismatch between patch and vulnerability views

The Vulnerabilities and Patches dashboards use different count semantics. A single patch can remediate multiple vulnerabilities, and one vulnerability can require different patches across platforms. Therefore, the severity counts are not expected to match one-to-one. Deploying a patch reduces only the vulnerabilities mapped to that patch.

The remediation labels can include Manual Fix Required and A fix for this vulnerability has not yet been released by the vendor. To check whether a CVE has a supported patch, open Supported Patches, add a filter for CVEID, enter the CVE, and apply the filter. If no patch is returned, submit a request through the feature-request portal.

Refer to Vulnerability Assessment and Prioritization.

8. Check for Superseded or Replaced Patches

Sometimes a patch expected by KB number or CVE mapping no longer appears as the active missing patch because it has been replaced by a newer patch.

In these cases, review whether the update has been superseded before concluding that the expected patch is missing.

To verify installation of the superseding update, open Patches → Detailed View, set Patch Status to Installed, and filter Patch Description by the complete KB number applicable to the endpoint's operating system. Use Patch Compliance Report to identify computers still missing that update. See Predefined Reports.

When the same application shows multiple vulnerability entries, deploy the latest applicable cumulative or superseding patch, confirm that installation succeeds, and scan the endpoint again. After the scan, vulnerability entries resolved by the patch are removed from the current vulnerable list.

You can manage or review superseded patch behavior from: Threats & Patches -> Settings -> Patch Database Settings.

A superseded patch can also remain under Downloaded Patches or Attention Required when its older vendor download URL is no longer active. See Upload Pending.

9. Compare Against Other Security Tools Carefully

If another scanner shows the vulnerability but Patch Manager Plus does not, compare the following first:

  • exact CVE ID
  • product version detected on the endpoint
  • scan time in both tools
  • whether the vulnerability is actually applicable
  • whether the other tool is showing a broader advisory while Patch Manager Plus is showing only applicable remediation items

Some vulnerabilities may appear in other tools first and later be removed in Patch Manager Plus after ManageEngine completes its applicability analysis. This behavior is described in the Vulnerability FAQ.

Specific cases after the standard checks

User-based vs system-based applications

Some third-party application updates are supported only when the application is installed system-wide. If an update is not listed as missing, verify whether the application was installed for all users rather than for an individual user, then install or update it in the supported scope.

For user-based applications, the user must be logged in during deployment. Only a limited set of user-based applications is supported. Check the supported applications list. To request support for an application that is not listed, submit a feature request.

Application update reports that the version is not applicable

If an application update reports that the version is not applicable, verify the installed application version, architecture, and installation scope. Deploy the current compatible package from Supported Patches, then run a Patch Database sync and patch scan to refresh the status.

If an uninstalled application continues to be detected, complete a clean uninstall using the vendor's supported removal method, remove only the residual application data identified by that vendor, and run another patch scan.

Application is not supported for patching

If an application appears under Software Inventory but not under Threats & Patches, the installed version may not be supported for patching. Upgrade it using the vendor-supported installer, then run a patch scan to check whether a supported update is detected. Microsoft Store and MSIX apps are not patched.

Application upgrade patch cannot be installed

An application upgrade patch can fail when the required base installer is missing or does not match the installed application. Verify the required base version and architecture, install the correct base application if needed, then retry the patch.

Patch remains missing until reboot

Some Windows updates remain detected as missing while their installation is pending a required restart. Complete the restart, run a fresh patch scan, then recheck Missing Patches and Installed Patches.

Patch name or description mismatch

If the displayed patch name or description does not match the expected update, run Patch Database Sync and rescan the endpoint. Compare the Patch ID and applicable operating system before deploying or escalating the metadata mismatch.

Deployment-Only patches

A patch labeled Deployment-Only is not automatically detected as missing and is not deployed merely because it is approved. Open Patch Mgmt → Patches → Supported Patches, select the Deployment-Only patch, and deploy it to the required computers. Some applications use a Deployment-Only prerequisite before the subsequent update can be detected as missing. After installing the Deployment-Only patch, run a patch scan so that any dependent update can be detected.

Patch eligibility in Automated Patch Deployment

An APD task deploys only patches that are approved, missing on the target, and included by the task's selected update types, severities, applications, and deployment criteria. If every applicable patch is unapproved or excluded, the task can show Patching Completed while the installed-patch count remains zero. If the latest or a newer application version is already installed, that application is not listed in the APD patch details or exported summary.

Review Approve Status under Missing Patches and the APD task's Select Applications settings. See Automate Patch Deployment.

.NET Hosting updates and architecture

A .NET Hosting Bundle servicing update applies when the corresponding Hosting Bundle is installed. It updates the relevant hosting, runtime, and security components but does not change the computer's architecture or replace an x64 installation with an x86 installation. Verify the installed .NET product and version before selecting a runtime, SDK, or Hosting Bundle patch.

Not Applicable counts in group deployments

A manual deployment created for a group can contain computers on which a selected patch is already installed or does not match the OS, architecture, or application state. Those computers are reported as Not Applicable. For this reason, the Not Applicable count in the deployment can be greater than the number of missing patches reported by an earlier scan of one computer.

Vendor has ended support for an application

New patches cannot be provided after the vendor stops releasing updates for an application. Check the vendor's support status and the latest version available under Supported Patches. If the application must be removed, use a supported software-uninstallation workflow where available.

Control Windows 10 ESU patch detection

Windows 10 Extended Security Update patches can be detected as missing regardless of ESU license activation. To stop detecting these updates, deploy Windows ESU Updates Disabler (Patch ID 95202) from Supported Patches to the required Windows 10 computers. To detect them again, deploy Windows ESU Updates Enabler (Patch ID 95203).

Third-party application deployment and security software

If a third-party application deployment does not complete as expected:

  • Security products such as SentinelOne, DLP, or antivirus can quarantine an executable, DLL, or other application component. Verify whether the security product flagged a detection, exclude the application path, and retry the deployment.
  • The patches you deployed may already be superseded by the latest version. Deploying the latest version replaces the older version. Confirm that the newly installed version is working as expected and that the old version is removed.

Cannot select a superseded patch

If you cannot select the checkbox next to a visible patch to mark it as approved or to download or install it, the patch has been superseded. Enable N-1 Patching for Windows under Patch Mgmt → Settings → N-1 Patching. See N-1 patching.

Missing Systems view is empty

If a patch remains listed under Missing Patches but the Missing Systems drill-down shows no systems, update the server and agents to supported builds with the latest available fixes. Run a Patch Database sync and patch scan, then check the view again. See Troubleshooting patch deployment errors.

Decline patches from Missing Patches

To decline patches from the Missing Patches view, navigate to Patch Mgmt (Threats and Patches) → Patches → Missing patches, search for the KB in the patch description column, select the patches, click Decline patches, and select the group. Repeat for each additional KB. See Decline Patch.

Declining a patch removes it from Missing Patches only for the selected group. Use All Computers when the patch must be declined throughout the managed scope. A declined, non-superseded patch remains visible in the Decline Patch view.

Declining a patch in Endpoint Central does not prevent the endpoint's native Windows Update service from installing it. If Windows Update is also active, use the supported controls described in Disable Windows Automatic Updates.

When the Issue Is Considered Resolved

The issue is considered resolved when one of the following is confirmed:

  • the patch or CVE becomes visible in the correct view after sync or scan
  • the patch is correctly identified as not applicable, superseded, optional, or unsupported
  • the endpoint state updates correctly after scan and reflects the expected patch status
  • the vulnerability is shown with the correct remediation method in the Vulnerabilities view

What to Collect if the Issue Still Persists

If the visibility still does not match your expectation, collect the following before escalation:

  • CVE ID or Patch ID
  • KB number if applicable
  • endpoint name
  • screenshot of the affected view
  • last Patch DB Sync time
  • last patch scan time for the endpoint
  • endpoint OS version, edition, and architecture
  • application version
  • screenshots from other tools if you are comparing results across scanners

Related