# Application vulnerabilities, runtime patching and message security

*MuleSoft Platform Integration Architect Study Guide · Designing integration solutions to meet security requirements · Last updated November 13, 2026 · https://www.certifyforce.com/study-guide/mulesoft-platform-integration-architect/designing-integration-solutions-to-meet-security-requirements/application-vulnerabilities-runtime-patching-and-message-security*

How to counteract Mule application vulnerabilities by deployment option: isolating browser-facing apps from the shared cloudhub.io domain, CloudHub 1.0 security patching and the monthly date-patch cycle, protecting property values on CloudHub 1.0 and CloudHub 2.0, Last-Mile Security, and message-level protection with the Cryptography module.

- Certification: Salesforce MuleSoft Platform Integration Architect
- Exam section: Designing integration solutions to meet security requirements
- Study guide: https://www.certifyforce.com/study-guide/mulesoft-platform-integration-architect

**Official exam objective:**

> Analyze and counteract potential security vulnerabilities of Mule applications.

## What the exam expects

- Recognize why browser-facing applications on the shared cloudhub.io domain are exposed, and move them to an isolated domain.
- Explain how CloudHub 1.0 handles operating system, JVM and Mule runtime vulnerabilities, including the security patch SLA, live patching and the monthly date-patch schedule.
- Choose how to keep a sensitive property value hidden on CloudHub 1.0, CloudHub 2.0, hybrid and Runtime Fabric deployments.
- Decide when TLS must terminate inside the Mule application rather than at the CloudHub 2.0 ingress.
- Select the Cryptography module strategy that protects a message itself, independent of the transport.

**Date patch:** the monthly backward-compatible Mule update, versioned Major.Minor.Patch - Date ([CloudHub Runtime Continuous Updates](https://docs.mulesoft.com/cloudhub/cloudhub-app-runtime-version-updates)). **Protected property:** a CloudHub 2.0 property whose value is never viewable or retrievable after it is set ([Protecting App Property Values](https://docs.mulesoft.com/cloudhub-2/ch2-protect-app-props)). **Safely hidden property:** the CloudHub 1.0 equivalent, listed under secureProperties ([Safely Hide Application Properties](https://docs.mulesoft.com/cloudhub/secure-application-properties)). **Last-Mile Security:** TLS for forwarded HTTPS connections terminates in the application ([Deploying Apps to Private Spaces](https://docs.mulesoft.com/cloudhub-2/ch2-deploy-private-space)).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| cloudhub.io cookies | Not isolated between customers | [Configuring Domains and Certificates](https://docs.mulesoft.com/cloudhub-2/ps-config-domains) |
| CloudHub security patch SLA | P0 within 7 days; P1 within 30 days | [CloudHub Runtime Continuous Updates](https://docs.mulesoft.com/cloudhub/cloudhub-app-runtime-version-updates) |
| Live patching eligibility | Apps on 90-day-old or newer releases | [CloudHub Runtime Continuous Updates](https://docs.mulesoft.com/cloudhub/cloudhub-app-runtime-version-updates) |
| Date patch schedule | Released first full week; applied third full week | [CloudHub Runtime Continuous Updates](https://docs.mulesoft.com/cloudhub/cloudhub-app-runtime-version-updates) |
| Unpatched for two months | Stopped and force-updated | [CloudHub Runtime Continuous Updates](https://docs.mulesoft.com/cloudhub/cloudhub-app-runtime-version-updates) |
| CloudHub 2.0 protected values | Encrypted in secrets manager; not retrievable | [Protecting App Property Values](https://docs.mulesoft.com/cloudhub-2/ch2-protect-app-props) |
| Hybrid hidden values | Remain visible after redeployment | [Safely Hide Application Properties](https://docs.mulesoft.com/cloudhub/secure-application-properties) |
| Last-Mile Security needs | App SSL certificate; more CPU | [Deploying Apps to Private Spaces](https://docs.mulesoft.com/cloudhub-2/ch2-deploy-private-space) |
| Cryptography strategies | JCE, PGP, XML | [Cryptography Module](https://docs.mulesoft.com/cryptography-module/latest/) |

## Check yourself

- When does kernel live patching skip a CloudHub 1.0 application that runs a recent release?
- Why does entering a CloudHub 2.0 property twice with Protect not protect both entries?
- Which two conditions let Mule 4 run in a FIPS 140-2 certified environment?
- When is it slower to update many CloudHub 1.0 apps through the Bulk Update API than one by one?

## Sources

- [CloudHub Runtime Continuous Updates](https://docs.mulesoft.com/cloudhub/cloudhub-app-runtime-version-updates)
- [Protecting App Property Values](https://docs.mulesoft.com/cloudhub-2/ch2-protect-app-props)
- [Safely Hide Application Properties](https://docs.mulesoft.com/cloudhub/secure-application-properties)
- [Configuring Domains and Certificates (TLS Context) for a Private Space](https://docs.mulesoft.com/cloudhub-2/ps-config-domains)
- [Deploying Apps to Private Spaces](https://docs.mulesoft.com/cloudhub-2/ch2-deploy-private-space)
- [Security](https://docs.mulesoft.com/mule-runtime/latest/securing)
- [Cryptography Module](https://docs.mulesoft.com/cryptography-module/latest/)
- [Hardening Mule Apps Deployed to Runtime Fabric](https://docs.mulesoft.com/runtime-fabric/latest/hardening-apps-deployed-runtime-fabric)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 6 linked practice questions, and unlimited timed mock exams are included with the MuleSoft Platform Integration Architect pack (USD $19): https://www.certifyforce.com/practice-exams