Whenever I upgrade the operating system of my virtual machines, I take a snaphot right after the upgrade.
This gives me a tree of different OS versions:
I give each snapshot a small descriptive name, that starts with the date of the snapshot (YYYYMMDD).
This allows me to revert to older versions to experiment with patched vulnerabilities, like this one.