Why do unpatched vulnerabilities keep driving ransomware incidents even when they are years old?

Why old vulnerabilities keep paying out for ransomware crews

Age does not make a weakness safer if it still exists on an exposed system with a reachable exploit path. Ransomware operators prefer vulnerabilities that remain common, easy to weaponize, and cheap to verify at scale. Older issues often fit that profile because patching is uneven, asset inventories are incomplete, and defenders lose attention once the headline fades.

Attackers also benefit from repetition. Once a flaw is widely understood, exploit code, scanning tools, and remediation guidance circulate broadly, which lowers the effort needed to find victims and increases the chance of success. The vulnerability may be old, but the exposed service, forgotten appliance, or delayed update cycle keeps it commercially useful.

Why “known” does not mean “fixed”

The main reason old vulnerabilities still matter is operational lag. Organisations may know about a flaw, yet still fail to patch it everywhere because of change windows, legacy dependencies, unsupported systems, or ownership gaps. That creates a long tail of exposure where a vulnerability remains reachable even after the initial disclosure rush has passed.

Ransomware groups do not need novelty when scale is the objective. A vulnerability that is easy to scan for, easy to validate, and present across many organisations can outperform a newer flaw that is harder to exploit. From an attacker’s perspective, the best targets are often the ones defenders assume are already behind them. For live exploitation patterns, CISA’s Known Exploited Vulnerabilities Catalog is a useful reminder that confirmed exploitation often persists well after disclosure.

Operationally, this is why remediation discipline matters more than vulnerability age. Teams that treat patching as a one-time event miss the reality that exposure is a moving state, not a historical fact. The older the issue, the more likely it is to be hidden in assets that are under-managed, but still internet-facing or reachable from trusted internal segments. Those gaps are exactly what ransomware crews look for.

Why ransomware actors still target ageing flaws

Ageing vulnerabilities often stay attractive because they sit at the intersection of low effort and high blast radius. A single exploit can provide initial access, privilege escalation, or remote code execution, which is enough to launch encryption, disable recovery paths, and move laterally before defenders react. Older flaws also tend to have a mature body of public knowledge, which makes them easier for criminals to operationalise.

Where the affected service is widely deployed, one exploit may work across many victims with little adaptation. That predictability is valuable to ransomware operators, who optimise for throughput rather than sophistication. In many campaigns, the goal is not stealthy persistence for months, but rapid monetisation before controls catch up. Threat intelligence sources such as the CISA cyber threat advisories and the ENISA Threat Landscape consistently show how ransomware blends opportunistic exploitation with post-compromise speed.

This dynamic is especially dangerous when the vulnerability sits in a service that exposes credentials, management interfaces, or remote administration paths. Once access is gained, the incident is rarely limited to a single host. The same old flaw can become the opening move for encryption, data theft, or deployment of additional payloads across the environment.

What defenders should expect when old flaws reappear

When an old vulnerability keeps showing up in ransomware cases, the problem is usually not just patch availability. It is the combination of incomplete inventory, weak prioritisation, and an assumption that “if it were exploitable, we would have heard about it already.” That assumption fails because adversaries reuse what works, especially when exposed services are slow to change.

The practical question is not whether a flaw is ancient, but whether it is still reachable in your environment. If the answer is yes, the vulnerability is current for you. The most useful evidence is exposure, not publication date: internet-facing placement, known exploit code, confirmed active exploitation, and weak compensating controls should all push the issue to the front of the queue. For highly structured prioritisation, the Known Exploited Vulnerabilities Catalog is the clearest signal that “old” can still mean “urgent.”

Risk and Threat Considerations

Old vulnerabilities become ransomware fuel when defenders leave reachable services unpatched long enough for attackers to industrialise them. The risk is not only initial compromise, but also the downstream loss of availability, data exposure, and recovery leverage once encryption or extortion begins.

Failure mechanism: Attackers scan for a known exploitable weakness, gain initial access through the exposed service, then use that foothold to deploy ransomware, steal data, or move laterally before detection catches up.

Impact: A flaw that looks obsolete on paper can still produce immediate business disruption, because attackers care about exploitability and reach, not disclosure age. When the same weakness is present across many assets, the organisation inherits a repeatable attack path with little warning.

Practitioner Guidance

What to prioritise: Treat confirmed exploitation, internet exposure, and privilege-bearing services as the deciding factors, not the age of the CVE. If a vulnerable asset can reach production data or management functions, it belongs ahead of low-impact backlog items.

What to verify: Verify whether the vulnerable component is still deployed, externally reachable, and covered by compensating controls such as segmentation, restricted access, or hardened configuration. If you cannot prove those protections exist, assume the exposure is active.

Common mistake: Teams often defer old vulnerabilities because they appear “well understood.” That is exactly when ransomware operators benefit, because predictable exploitation paths are cheaper to automate and easier to scale.

Practitioner takeaway: Vulnerability age is a weak indicator of risk. Reachability, exploitability, and business impact determine whether an old flaw is dormant history or an active ransomware doorway.

Related resources from NHI Mgmt Group

• Why does identity matter more when vulnerabilities are discovered faster than they can be patched?
• Why do secrets stay dangerous even when they are no longer actively used?
• Why do backups fail during ransomware incidents even when they exist?
• Why do old PHP vulnerabilities keep getting exploited years after disclosure?