You don't sound like a developer, more IT/ops side so let me try to put this in perspective. The existing security holes in their code are going to be given eq

You don't sound like a developer, more IT/ops side so let me try to put this in perspective. The existing security holes in their code are going to be given equal weight with these concerns. Now unless you know what their bugfix backlog is, there's no reason to think security upgrades are a bigger priority than say PCI audits or whatever. Unless there's a demonstrable value to fix this OVER all other security issues, only then would it make sense to hustle with a emergency fix. And the thing about emergency patching is that you can't just toss your "solution" into the product. At the very starting line of sanity you need to research the risk an upgrade will have on your system. Don't think of the environment the system is hosted on, but the code itself. That takes someone really smart and expensive to get pulled off whatever they were working on that generates money and focus on this security issue (over all others). They research, document and propose an upgrade path. Code will need to be refactored, tested system wide and then QA/UAT will chew on it. Data may need to be migrated or transformed (in production, risky!). And that's all if they know the right way to do it! If you're unlucky you get a panicking CTO or boss who (read this article on hacker news and) demands a quick fix. In that case you upgrade the server, throw code up and fix related bugs for months. Who knows, maybe none of them will be security holes!