The EOL Blind Spot: Why Your Vulnerability Scanners Are Missing Critical Flaws
Security teams are facing a critical blind spot as industry-standard vulnerability scanners fail to report flaws in end-of-life (EOL) software, leading to a massive volume of unflagged, exploitable components.
Security teams are facing a significant "blind spot" in their vulnerability management programs, as industry-standard Software Composition Analysis (SCA) tools and CVE feeds frequently fail to report vulnerabilities in end-of-life (EOL) software. Because maintainers prioritize investigating and patching currently supported versions, older software often falls outside the officially documented affected ranges of new CVEs, leaving organizations with a false sense of security BleepingComputer.
The technical mechanism behind this gap is rooted in how CVEs are filed. When a vulnerability is discovered, maintainers define an affected version range. If an organization is running an EOL version that falls outside this range, their scanners will not trigger an alert—not because the software is secure, but because the vulnerability was never investigated for that specific version. According to Sonatype’s 2026 State of the Software Supply Chain report, this issue contributed to 167,286 false negatives in 2025 alone, where exploitable components went entirely unflagged BleepingComputer.
A concrete example of this phenomenon is CVE-2026-22732, a critical vulnerability in Spring Security with a CVSS score of 9.1. The flaw causes critical security response headers—such as Cache-Control, X-Frame-Options, and Content-Security-Policy—to be silently dropped in certain servlet configurations. While the official affected range covers versions 5.7.x through 7.0.x, Spring Security 6.2.x, which reached EOL in December 2025, is excluded from the record. Consequently, organizations running Spring Boot 3.2, which includes the affected 6.2.x version, receive no notification from their security tools BleepingComputer.
The scale of this problem is substantial. Research from HeroDevs indicates that for approximately 80% of CVEs disclosed on supported packages, an EOL version is also affected, yet remains unlisted in official records. This suggests that the actual "blast radius" of most vulnerabilities is significantly wider than what is reported in standard CVE feeds. Furthermore, the industry currently relies on limited data sources like endoflife.date, which tracks only about 350 projects, potentially masking the true extent of EOL software usage across enterprise environments BleepingComputer.
As the global volume of CVEs continues to rise—doubling in just five years—the investigative bandwidth required to cover legacy release lines is becoming increasingly scarce. This trend highlights a systemic reliance on incomplete data, where security teams are effectively blind to risks in older, yet still deployed, software components. Moving forward, organizations may need to look beyond automated scanner outputs and consider specialized support for legacy software to mitigate these hidden vulnerabilities BleepingComputer.