Patch Severity, Scheduling and Roles
modulePatch Management (ITOM)
Updated 17 Oct 2026
Patch Severity, Scheduling and Roles
Product: NEXTMEGABYTE (Greenitco ITAM) · Module: Patch Management (ITOM) · Audience: Administrator
Severity levels
After sync, patches are classified by severity for priority-based deployment.
| Severity |
CVSS score |
Description |
Recommended action |
| Critical |
9.0 – 10.0 |
Actively exploited vulnerability with severe impact |
Deploy immediately (Policy 5) |
| High |
7.0 – 8.9 |
Serious vulnerability with significant risk |
Deploy within 24–48 hours |
| Medium |
4.0 – 6.9 |
Moderate risk, limited exploitability |
Deploy within 7 days |
| Low |
0.1 – 3.9 |
Minimal risk |
Deploy within 30 days |
| Informational |
N/A |
Non-security updates and feature improvements |
Next maintenance window |
Auto-approval rules by severity
Administrators can configure auto-approval rules, for example:
| Severity |
Rule |
| Critical |
Auto-approve and deploy with Policy 5 |
| High |
Auto-approve and deploy with Policy 3 |
| Medium |
Queue for review; deploy with Policy 1 or 2 |
| Low |
Hold for administrator approval; deploy with Policy 1 |
| Informational |
Manual deployment only |
Time-based installation (maintenance windows)
| Option |
Description |
| Before 6:00 AM |
Off-hours patching (recommended for servers) |
| After 6:00 AM |
Business-hours patching with user consent (Policy 1 or 2) |
| Custom window |
Any start and end time, for example 10:00 PM – 4:00 AM |
| Blackout period |
No patching during set times (for example business-critical hours) |
| Day-of-week filter |
Weekdays, weekends or specific days only |
| Scenario |
Policy |
Time trigger |
| Server patching, no downtime allowed |
Policy 3 or 4 |
Before 6:00 AM |
| User workstations during business hours |
Policy 1 or 2 |
After 6:00 AM |
| Emergency zero-day patch |
Policy 5 |
Immediately |
| Scheduled maintenance window |
Policy 4 |
Custom window |
What administrators and users can do
| Capability |
Administrator |
User |
| View patch status of all endpoints |
Yes |
No (own device only) |
| Create and assign deployment policies |
Yes |
No |
| Push immediate deployments (Policy 5) |
Yes |
No |
| Approve or reject patches |
Yes |
No |
| Configure maintenance windows |
Yes |
No |
| Manage patch exclusion lists |
Yes |
No |
| View reports and audit logs |
Yes |
Own history only |
| Install patches through a pop-up (Policy 1 and 2) |
— |
Yes |
| Defer or snooze patches |
— |
Yes, within administrator limits |
- Admin-only deployment: administrators can make critical patches admin-initiated only, so users cannot trigger or cancel them.
- User (self-service) deployment: selected non-critical patches can be offered for users to install on demand from the self-service portal.
