Failure pattern · 8 documented incidents

Known vulnerability left unremediated

A patch or fix exists, but the vulnerable component keeps running because nobody knew it was there or owned the fix.

See it happen

Watch how this failure unfolds, then switch to the same situation with the safeguard in place. Click any step to replay it.

Scroll the diagram sideways to see every system.

12 / 12 s

A known, fixable flaw becomes a breach.

What goes wrong:

  1. A fix for a critical flaw is published.
  2. One server running it is not in any inventory, so nobody patches it.
  3. Months later, attackers scanning the internet find it.
  4. A known, fixable flaw becomes a breach.

With the safeguard:

  1. A fix for a critical flaw is published.
  2. Every running component is inventoried with an owner and a deadline.
  3. The patch is applied before the deadline.
  4. The scan finds nothing to exploit.

What it is

A fix exists, sometimes for months, but the vulnerable component keeps running. Usually nobody knew it was there, or nobody owned the job of patching it.

How it happens

  • Components and dependencies aren’t tracked in an inventory
  • Patches have no owner and no deadline
  • Old systems keep running after everyone forgot about them

What it causes

  • Breaches through flaws that had public fixes
  • Mass exploitation once a vulnerability makes the news
  • Painful, rushed emergency patching

Warning signs

  • Nobody can quickly answer “where do we run this library?”
  • Known exploited vulnerabilities open past their deadline
  • Servers and services with no listed owner

How to prevent it

Know what you run and patch on a deadline. Keep a software inventory (SBOM), track advisories for every dependency, set remediation deadlines by severity and escalate missed deadlines to the people who own the risk.

  • Every running component and dependency is in an inventory, such as an SBOM, with an owner
  • Known exploited vulnerabilities get a patch deadline measured in days
  • Systems nobody owns are found and either adopted or shut down

Key ideas:Software bill of materials (SBOM)Known Exploited Vulnerabilities (KEV)

Check your system against the full launch checklist

Real incidents with this pattern

Documented incidents first. Each links to its public source.

Open in the database
Documented incidentDisclosed 2023-06-07

SQL injection in MOVEit Transfer exploited by the CL0P ransomware gang (2023)

CISA and the FBI report that the CL0P ransomware gang exploited a SQL injection vulnerability (CVE-2023-34362) in Progress MOVEit Transfer beginning May 27, 2023, installing a web shell called LEMURLOOT.

Safeguard: Patch internet-facing transfer tools immediately

Known vulnerability left unremediatedcisa.gov
Documented incidentDisclosed 2021-12-10

Log4Shell: remote code execution through JNDI lookups in Apache Log4j (2021)

CVE-2021-44228 (Log4Shell) affects Apache Log4j 2.0-beta9 through 2.14.1 and lets an unauthenticated remote actor execute arbitrary code through JNDI lookups.

Safeguard: Maintain a software bill of materials and patch fast

Known vulnerability left unremediatedcisa.gov
3 security advisories and illustrative scenarios with this pattern

In the standards

CollectSEA's mapping; not an official determination by the standards bodies.