CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

End-Of-Life Software Blind Spots in CVE Ecosystem Expose Organizations to Unmonitored Vulnerabilities

First reported
Last updated
1 unique sources, 2 articles

Summary

Hide ▲

Security teams remain unaware that end-of-life (EOL) open source software versions are systematically excluded from CVE investigations and scanner alerts due to investigative and scale limitations within the vulnerability disclosure ecosystem. The CVE ecosystem’s focus on supported versions creates a blind spot where EOL versions—often still present in enterprise environments—receive no official scrutiny, even when affected by disclosed vulnerabilities. Maintenance capacity constraints, driven by a doubling of global CVE volume in five years and a 37x surge in unscored CVEs, force maintainers to prioritize supported releases, leaving older versions uninvestigated. Approximately 80% of new CVEs affecting supported versions are later found to also impact EOL versions, yet these are not reflected in advisories. Public EOL data sources like endoflife.date track only ~7,000 EOL versions across 350 projects, while Sonatype and HeroDevs analysis reveals over 5.4 million EOL versions across major package registries, with 5–15% of enterprise dependency graphs containing EOL components. This exposure gap is exacerbated by AI-driven vulnerability research, which accelerates discovery of flaws in unsupported codebases but does not close the investigative gap for EOL software, further widening the risk for abandoned codebases.

Timeline

  1. 05.05.2026 17:00 2 articles · 12h ago

    CVE Investigative Blind Spot Excludes EOL Software Versions from Advisories and Scanner Alerts

    Maintainers exclude EOL versions from CVE investigations primarily due to overwhelming investigative workload, as global CVE volume has doubled in five years and unscored CVEs increased 37x in 2026, leaving no bandwidth for older release lines. This results in silent exposure where EOL versions are affected by disclosed vulnerabilities but receive no alerts or patches. Sonatype’s 2026 State of the Software Supply Chain report identified 167,286 false negatives in 2025 due to EOL versions being omitted from advisories, and HeroDevs confirmed Spring Security 6.2.x (EOL December 2025) is affected by CVE-2026-22732 (CVSS 9.1) despite the official affected range excluding it. The scale of EOL versions is far larger than public sources indicate: endoflife.date tracks ~7,000 EOL versions across 350 projects, while analysis of 12 million package versions across major registries reveals 5.4 million EOL versions, with 25% of npm, 18% of NuGet, 13% of Cargo, 11% of PyPI, and 10% of Maven Central versions affected. Transitive dependencies carry the majority of this hidden exposure. AI-assisted vulnerability research initiatives like Anthropic’s Project Glasswing accelerate discovery in unsupported codebases but do not close this gap, further widening the exposure for abandoned codebases.

    Show sources
    Open in new tab

Information Snippets

Similar Happenings

Escalating exposure gap in mid-market vulnerability management amid CVE volume surge and rapid exploitation timelines

Mid-market security teams increasingly rely on CVE-based vulnerability tracking, but experts warn this approach creates critical blind spots in real-world exposure management. Exploitation timelines have collapsed from months to hours, with potential for minutes or even seconds, escalating risk for organizations unable to patch within 30 days. Traditional CVE-only strategies overlook critical exposures such as misconfigured databases, exposed management interfaces, and overlooked attack surface elements despite patch deployments, leaving fully patched environments vulnerable to compromise.

Open in new tab

Critical Vulnerabilities Patched in SAP, Microsoft, Adobe, and HPE Products

Multiple vendors, including SAP, Microsoft, Adobe, and Hewlett Packard Enterprise (HPE), have released security updates to address critical vulnerabilities that could lead to arbitrary code execution, privilege escalation, and authentication bypass. These flaws affect a wide range of enterprise software and network devices, posing significant risks to organizations. SAP patched two critical vulnerabilities: CVE-2019-17571 (CVSS 9.8) in SAP Quotation Management Insurance and CVE-2026-27685 (CVSS 9.1) in SAP NetWeaver Enterprise Portal Administration. Microsoft released patches for 84 vulnerabilities, including remote code execution flaws. Adobe addressed 80 vulnerabilities, with four critical flaws in Adobe Commerce and Magento Open Source. HPE fixed five vulnerabilities in Aruba Networking AOS-CX, including a severe authentication bypass flaw (CVE-2026-23813, CVSS 9.8). The patches highlight the ongoing need for vigilance in addressing vulnerabilities across enterprise software and network devices.

Open in new tab

87% of Organizations Have Exploitable Software Vulnerabilities in Production

A report by DataDog reveals that 87% of organizations have at least one exploitable software vulnerability in production, affecting 40% of all services. Vulnerabilities are most common in Java (59%), .NET (47%), and Rust (40%) services. Only 18% of critical dependency vulnerabilities remain critical after adjusting severity scores with runtime and CVE context. The report also highlights risks at both ends of the software lifecycle, including outdated dependencies and rapid adoption of new library versions.

Open in new tab

OpenSSL Vulnerabilities in Versions 3.5.4, 3.4.3, 3.3.5, 3.2.6, 3.0.18, 1.0.2zm, and 1.1.1zd

The OpenSSL Project has released updates to fix three vulnerabilities in multiple versions of the OpenSSL library. The vulnerabilities, tracked as CVE-2025-9230, CVE-2025-9231, and CVE-2025-9232, allow for private key recovery, arbitrary code execution, and denial-of-service (DoS) attacks. The most severe flaw, CVE-2025-9231, affects the SM2 algorithm implementation on 64-bit ARM platforms, potentially enabling attackers to recover private keys and decrypt encrypted traffic or conduct man-in-the-middle (MitM) attacks. The other two vulnerabilities, CVE-2025-9230 and CVE-2025-9232, have moderate and low severity ratings, respectively. The vulnerabilities were discovered in versions 3.5.4, 3.4.3, 3.3.5, 3.2.6, 3.0.18, 1.0.2zm, and 1.1.1zd of the OpenSSL library. The updates are available for immediate deployment to mitigate the risks associated with these vulnerabilities.

Open in new tab

GitHub Risk Vectors in Software Development Life Cycle

GitHub has become integral to modern software development, but its extensive use introduces numerous risk vectors across the software development life cycle (SDLC). These vectors create blind spots that attackers exploit, as seen in incidents like the tj-actions GitHub Action and XZ Utils compromises. Organizations often overlook these risks while focusing on dependency scanning. The following vectors are identified: dependency management, container builds, Kubernetes deployments, configuration management, CI/CD automation, code organization, infrastructure provisioning, build tools, developer workflows, and cross-repository triggers. These vectors highlight the need for comprehensive supply chain governance and proactive security measures to protect against sophisticated supply chain attacks. Organizations must inventory all GitHub references, standardize on pinned immutable references, implement integrity verification, and develop secure internal alternatives for common external dependencies.

Open in new tab