Unpatched web-application vulnerability (Apache Struts) leads to the Equifax breach (2017)
Apache Struts CVE-2017-5638 parser bug left unpatched for 2 months; attackers executed arbitrary commands and accessed unencrypted databases of 147M Americans.
The failure pattern
Watch the pattern: Known vulnerability left unremediated
Safeguards that address it
CollectSEA's engineering analysis of what would have prevented or contained this failure.
- Patch critical vulnerabilities on a defined deadlineMaintain an asset inventory, scan for affected components and enforce a short remediation deadline for actively exploited issues.
- Keep inspection and monitoring effectiveMonitor certificates and traffic inspection so exfiltration of sensitive data is detectable, and encrypt sensitive stores.
Related standards
CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.
- AU-3 Content of Audit Records
- RA-5 Vulnerability Monitoring and Scanning
- SI-2 Flaw Remediation
- RV.1.1 Gather vulnerability information from public sources
- RV.2.2 Plan and implement risk responses
- MANAGE 4.3 Track and communicate incidents and errors
- Goal 4 Security patches
- Goal 7 Evidence of intrusions
- CWE-778 Insufficient Logging
- CWE-1395 Dependency on Vulnerable Third-Party Component
Building something similar?
Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.
Incidents with the same pattern
"ToolShell" vulnerabilities in on-premises SharePoint are exploited to steal server keys (2025)
Microsoft observed attackers exploiting on-premises SharePoint Server vulnerabilities (CVE-2025-53770 and CVE-2025-53771, related to CVE-2025-49704 and CVE-2025-49706) against internet-facing servers, with attempts as…
SQL injection in MOVEit Transfer exploited by the CL0P ransomware gang (2023)
CISA and the FBI report that the CL0P ransomware gang exploited a SQL injection vulnerability (CVE-2023-34362) in Progress MOVEit Transfer beginning May 27, 2023, installing a web shell called LEMURLOOT.
Log4Shell: remote code execution through JNDI lookups in Apache Log4j (2021)
CVE-2021-44228 (Log4Shell) affects Apache Log4j 2.0-beta9 through 2.14.1 and lets an unauthenticated remote actor execute arbitrary code through JNDI lookups.
Capital One cloud breach and an $80 million OCC penalty for weak cloud-migration risk assessment (2019)
The OCC assessed an $80 million civil money penalty against Capital One for failing to establish effective risk assessment processes before migrating significant IT operations to the public cloud and for not correcting…
F5, Inc. discloses a cybersecurity incident with data taken without authorization (SEC 8-K, October 2025)
On August 9, 2025, F5, Inc. (the “Company”, “F5”, “we”, or “our”) learned that a highly sophisticated nation-state threat actor had gained unauthorized access to certain Company systems.
Call and text records of nearly all AT&T wireless customers taken from a third-party cloud workspace (2024)
Contractor credentials without MFA accessed third-party cloud data warehouse; downloaded 109 million customer call and text records.