tldr: My applications and COTS don't use .NET, and my Windows 7 clients have up to .NET 3.5 installed by default. Is it a security vulnerability to not install and maintain the latest .NET 4.x version?
As an engineer maintaining users' machines in operations & support, part of my job scope is to ensure they always have the latest patches installed. My clients are installed with Windows 7 which has .NET 3.5 by default, so I need to keep them patched with the latest .NET 3.5 security updates, even though none of the deployed applications nor installed COTS have any .NET dependency. However, .NET 4 is always brought up in every monthly scan of the clients for missing patches.
From what I can find online, it's said that you should install the .NET versions you need, but that's from the development standpoint. What about from the standpoint of maintenance in the production environment? As an analogy, it is recommended to always deploy the latest compatible Python version as it contains the latest security and bug fixes (e.g. if the application was developed in Python 3.6, you are recommended to patch to Python 3.9 in production if the application doesn't break). Does this principle also apply to .NET?
