Topic starter
27/10/2026 7:03 pm
TL;DR: Patch backlogs are giving attackers a wider window to exploit older flaws, and Coalition reports that vulnerability exploitation became the leading initial access vector in 2025, accounting for 31% of all breaches. Security teams now need prioritised remediation based on exploitability and exposure, not equal treatment for every CVE.
Editorial analysis by NHI Mgmt Group, based on content published by Coalition: “What’s Old Is New Again: Attackers Target Resurgent Vulnerabilities”.
By the numbers:
- Vulnerability exploitation was the leading initial access vector in 2025, accounting for 31% of all breaches.
Key questions
Q: What should teams do first when an older vulnerability becomes active again?
A: Start with exposure validation, not patch theatre.
Q: Why does delayed patching continue to create risk even for older, well-publicized vulnerabilities?
A: Delayed patching keeps known attack paths open long after a flaw becomes public.
Q: What are the signs that a vulnerability prioritization model is failing?
A: The clearest signs are long delays on known exploited vulnerabilities, tickets that lack ownership, duplicate findings across tools, and high-severity work that never maps to real attack paths.
Practitioner guidance
- Prioritise exposed vulnerabilities over inventory age Use external exposure, exploit evidence and asset criticality to rank remediation instead of treating all backlog items equally.
- Review third-party access paths and OAuth grants Identify connected applications, delegated tokens and broad permissions that could be abused without a software exploit.
- Separate hosted and self-managed remediation ownership Document who patches, who verifies and who escalates when a vulnerability sits inside a provider-managed platform.
Bottom line: Older vulnerabilities can become active threats again when remediation lags and exposed instances remain reachable.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →