Most Critical Vulnerabilities Missed by Vendor Advisories, Armadin Report Finds
A new report from Armadin reveals that 88% of critical and high-severity vulnerabilities found in live attack tests were missed by vendor advisories, highlighting significant gaps in traditional vulnerability management.
A significant majority of critical and high-severity vulnerabilities discovered during live attack simulations this year went unnoticed by traditional vendor advisories and external security intelligence, according to a new report from offensive security startup Armadin. The findings, based on AI-driven attacks against client systems across various industries, indicate that 88% of these severe weaknesses were not flagged by conventional security channels.
The report, published on November 2, underscores a critical disconnect between the vulnerabilities organizations face in real-world attack scenarios and the information provided through standard vendor notifications. This gap poses a substantial risk, as security teams may be unaware of the most pressing threats within their environments.
Digging deeper into the nature of these overlooked flaws, Armadin found that internally developed software defects accounted for a substantial portion of the critical (67%) and high (78%) severity issues. Additionally, misconfigurations of vendor products, such as internet-exposed administrative consoles, represented another significant category (24% of critical, 22% of high findings). Even zero-day vulnerabilities, though fewer in number, were sometimes subject to lengthy disclosure delays by vendors, with one instance taking nearly four months for an advisory to be issued.
A particularly concerning trend identified is the prevalence of vulnerabilities accessible without authentication. Nearly 70% of critical and high findings were located on the unauthenticated attack surface. Furthermore, 82% of documented attack chains began without requiring any credentials, and a striking 56% of these progressed without ever needing a password or key. In over 70% of client environments, Armadin reported achieving critical outcomes within three steps or fewer, bypassing authentication entirely.
The path to exploitation often involved exposed service accounts, which were crucial in nearly half of the credential-less attack chains. These accounts, rather than human users, were the source of 71% of exposed credentials, frequently found in easily accessible locations like code repositories, configuration files, backups, or cloud settings. One illustrative example detailed how an attacker, starting with an unprivileged domain account, exploited a flaw in backup software to access credentials, ultimately leading to domain administrator privileges.
Addressing these severe findings required a multi-faceted approach. Shipping application code updates was necessary in 51% of cases, while modifying settings, permissions, or policies was required in 43%. Rotating exposed credentials was also a common remediation step (32%), with many incidents necessitating multiple corrective actions. Armadin's recommendations emphasize robust policies for provisioning, storing, and rotating service account credentials, alongside diligent checks of code repositories and pipelines for exposed secrets.
Crucially, Armadin's analysis revealed that the responsibility for fixing 93% of these severe, overlooked vulnerabilities lay squarely within the organization's own hands, requiring internal action rather than reliance on third-party patches or vendor fixes. This highlights the growing importance of continuous exposure assessment and proactive internal security hygiene.
The report's findings serve as a stark reminder that traditional vulnerability management, heavily reliant on vendor advisories and known exploits, may not be sufficient to protect against the full spectrum of threats. Organizations must adopt more comprehensive strategies that include continuous monitoring of their attack surface and a deeper understanding of their internally developed software and system configurations.