You can apply Site Recovery Manager security updates and patches as they are made available by VMware.
Applying Site Recovery Manager Patches and Security Updates to the Site Recovery Manager Virtual Appliance
You apply Site Recovery Manager security patches and updates by performing an update of your existing Site Recovery Manager Virtual Appliance installation. For information about updating the Site Recovery Manager Virtual Appliance, see the Update the Site Recovery Manager Virtual Appliance topic in Site Recovery Manager Installation and Configuration.