That critical vulnerability might <em>not</em> be the first you should patch