A provider publishes a critical vulnerability affecting managed database software. What should the customer do first operationally?

1. Assume every managed database was already patched without checking
2. Attempt to patch inaccessible provider host operating systems directly
3. Delete all application audit records before maintenance
4. Confirm service exposure and coordinate remediation under the shared responsibility model