A security analyst runs a vulnerability scan on a network administrator's workstation. The network administrator has direct administrative access to the company$$s SSO web portal. The vulnerability scan uncovers critical vulnerabilities with equally high CVSS scores for the user's browser, OS$,$ email client, and an offline password manager. Which of the following should the security analyst patch FIRST?

A$.$ Email client

B$.$ Password manager

C$.$ Browser

D$.$ OS