Don’t make it available from internet. This will solve the issue.
If it is not possible, once the cve is published and properly described, perhaps there is another way to secure it via an external proxy or even a waf.
If you have unsupported Sw, it is always a pain in the ass to keep them secure so try to figure out always the first point
Another one selfhosting contacts, calendar, notes and so on with that non-interoperable protocol.
And for the shake of honesty I need to say that while doable it is true that the situation could be highly improved with a lot of non standard stuff that private apps are implementing outside of the standard compliance