Your refresh plan has a CVE blind spot