On May 12, 2017, the WannaCry ransomware worm began spreading across the internet, and within days it had reached more than 200,000 computers in about 150 countries. It got in through a flaw in Windows file sharing that Microsoft had patched two months earlier. The machines it crippled, including hospital systems across England's National Health Service, were ones nobody had updated, plus some so old that no update existed for them until Microsoft made a rare emergency exception.
WannaCry is the textbook case for the weaknesses in this lesson. On the CompTIA Security+ SY0-801 exam they sit under objective 2.4, which expects you to recognize the kinds of vulnerabilities organizations carry and the places attackers find them. This lesson covers four conditions that leave a system exposed no matter how good its software once was: unsupported, unpatched, obsolete and unmanaged. It also covers what to do when a system can't be fixed and still has to keep running.
An unsupported product will never get another security fix
Every commercial product has a support life cycle. During mainstream support the vendor fixes bugs and adds features. Many vendors then offer a period of extended support with security updates only. After that ends, a point usually called end of life (EOL) or end of service life (EOSL), the vendor stops publishing fixes. Any vulnerability found from that day on stays open for good.
The dates are published years in advance. Windows 7 lost support in January 2020, Windows Server 2012 and 2012 R2 in October 2023, and Windows 10 in October 2025. Microsoft sold Extended Security Updates for each, a paid bridge of up to three years for organizations that couldn't migrate in time. That pattern is typical: vendors may sell a short extension, never an indefinite one.
Attackers watch those dates too. When a vendor fixes a flaw in its current version, the same flaw often exists in the older version it no longer supports, and the published fix shows attackers where to look. Flaws that will never be fixed are sometimes called forever-days.
Unsupported doesn't only mean operating systems. It covers network appliances and their firmware, applications whose vendor went out of business, and open-source software whose maintainers moved on. Python 2 reached end of life on January 1, 2020, and CentOS 7 on June 30, 2024, and both still turn up on production servers. A library nobody maintains is unsupported even if it never had a vendor.
On the exam, wording such as end of life, end of support, discontinued or the vendor no longer releases updates points to an unsupported product. The real fix is to upgrade or replace it. "Apply the latest patches" is the usual distractor, and it is wrong because there are none to apply.
An unpatched system has a fix available that nobody has installed
An unpatched system is different: the vendor has released a fix, and it hasn't been installed. The time between a patch's release and its installation is called patch lag, and most real-world exploitation happens inside it. WannaCry hit systems two months after the fix shipped, and many intrusions still use flaws that were patched years ago.
Releasing a patch also tells attackers where the flaw is. Microsoft publishes its monthly security updates on the second Tuesday of each month, Patch Tuesday, and researchers and attackers compare the patched and unpatched code to find what changed. Working exploits for some flaws follow within days, which is why the following day is sometimes called Exploit Wednesday. CISA's Known Exploited Vulnerabilities (KEV) catalog lists flaws being used in real attacks, and U.S. federal civilian agencies must fix each one by a set due date, often within a few weeks.
Systems stay unpatched for ordinary reasons:
- No maintenance window: a server that runs a 24-hour production line or a hospital ward can't restart whenever an update arrives.
- Fear of breakage: an update that once crashed a business application makes its owner reluctant to install the next one.
- Vendor restrictions: support contracts for medical and industrial equipment often forbid patches the equipment vendor hasn't validated.
- Partial coverage: the operating system updates automatically, but browsers, runtimes, PDF readers, firmware and appliances don't.
- No owner: nobody is sure who is responsible for the system, so nobody schedules the work.
Each reason has a process answer: maintenance windows agreed in advance, a test group that receives patches first, contracts that require timely vendor validation, and patch tools that cover third-party software and firmware. Ranking missing patches is covered in the lesson on prioritizing vulnerabilities, and the remediation process in the vulnerability management section.
On the exam, a scenario that mentions a patch released weeks or months ago describes an unpatched system, not a zero-day. A zero-day has no patch at all.