...
One significant factor we consider when determining vendor status is the extent to which vendors or users need to perform some mitigating activity. In the most common case, a affected vendors develop and release changed software (e.g., patch, upgrade, update) and users deploy the changed software.
...