Why decade-old CVEs still land in KEV

Between 1 January and 10 November 2026, CISA added 289 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. 15 of them carry a CVE ID from 2016 or earlier, the oldest from 2008. They include the Windows Server service flaw behind MS08-067, a ProFTPD file copy bug from 2015 and an Apache Struts command injection from 2016. To many teams these look like museum pieces. In KEV terms they are current: someone was seen exploiting them recently enough for CISA to act.

This analysis looks at the numbers behind that pattern, the 2026 batches that produced it and what it should change in day-to-day vulnerability management.

The numbers

We mirror the full KEV feed daily (1,773 entries as of 9 November 2026). For every entry we compared the year in the CVE ID with the year CISA added it to the catalog. In 2026 so far, 29 additions (10.0 percent) were at least five years old when they were added, and 15 were at least ten years old.

2022 is the outlier. The catalog launched in November 2021, and during 2022 CISA added large batches of historical vulnerabilities with established exploitation records. Since then, the share of old additions has settled at around one in ten. The number of decade-old additions, however, has risen each year since 2023: 3, 7, 9 and now 15 with seven weeks of the year left.

The old 2026 additions also stand out in exploitation likelihood. Their average current EPSS score is 0.58, compared with 0.40 for the newer additions, and 18 of the 29 score 0.5 or higher. None of them is flagged as known ransomware use, against 27 of the 260 newer additions.

The 2026 batches

Old CVEs rarely arrive alone. In 2026 they came in clusters that usually followed a public threat report.

• 17 February: CVE-2008-0015, a stack overflow in the Windows Video ActiveX control. Microsoft notes that the exploit was used to deliver the Dogkild worm, which spreads via removable drives. Old worms keep circulating on unmanaged machines long after their exploits stop making news.
• 20 May: five Microsoft and Adobe flaws from 2008 to 2010 in a single batch, among them CVE-2008-4250, the Server service bug behind MS08-067 and the Conficker worm. Neither CISA nor the press coverage explained the trigger. For CVE-2010-0806, earlier reporting attributes zero-day use to the GREF group, but that is historical, not the 2026 evidence.
• 26 August: Red Hat libuser (CVE-2015-3246) and ABRT (CVE-2015-5287), added together with AjaxPro (CVE-2021-23758) and a Linux kernel flaw. The addition followed a Cisco Talos report on UAT-10147, which uses web application exploits for initial access and then a set of Linux local privilege escalation exploits after placing a web shell.
• 8 October: ProFTPD (CVE-2015-3306), ISC BIND (CVE-2015-5477) and Apache Struts (CVE-2016-3081), plus ONLYOFFICE and Strapi, on the same day as joint advisory AA26-281A by agencies from seven countries on Flax Typhoon and the China-based Integrity Technology Group. Shellshock (CVE-2014-6278) from the same toolset had already been added in October 2025.

Why old CVEs keep appearing

KEV is driven by evidence, not by age. CISA lists three criteria: an assigned CVE ID, reliable evidence of exploitation in the wild, and a clear remediation action. The age of the vulnerability is not a factor. Scanning, research exploits and public proofs of concept do not count as evidence; an attempted or successful attack by an actor does. An old CVE therefore enters the catalog when someone documents its use in a form CISA can rely on. In 2026 that was typically a vendor threat report or a government advisory.

Our assessment of the underlying drivers, based on the batches above:

• The long tail of legacy systems. Struts 2 applications, ProFTPD with mod_copy and old BIND builds still run on servers and appliances that nobody owns any more. For an actor scanning at internet scale, a ten-year-old bug on a forgotten host is as useful as a new one and much cheaper.
• Old local exploits as a cheap second stage. The UAT-10147 chain shows the pattern: a web shell first, then a kit of local privilege escalation exploits that covers many kernel and userland versions. On long-lived servers, a 2015 libuser bug can still be the shortest path to root.
• Toolsets are cumulative. Actor tooling rarely drops old exploits. When a government advisory finally lists the full toolset, old CVEs that were in use all along become documentable at once.
• Commodity malware outlives its news cycle. Worms such as Dogkild and the MS08-067 family keep spreading on unmanaged Windows machines, removable media and isolated networks.
• The signals are there. Most of the old 2026 additions score high in EPSS today, which points to exploitation activity that is visible well beyond CISA's own evidence.

What it means for defenders

• Do not filter scanner results by CVE publication date. The relevant date for prioritisation is the KEV dateAdded, not the year in the ID. A rule such as "ignore everything older than five years" would have hidden 29 KEV additions in 2026 alone.
• Treat KEV additions of old CVEs as an asset inventory test. If a 2015 ProFTPD or BIND entry appears, the real question is whether you know every host that still runs it, including appliances and vendor images.
• Plan for end-of-life. For many old entries there is no supported patch on the platform you run. BOD 22-01 allows two outcomes: apply the vendor update or stop using the product. Mitigations such as disabling Struts Dynamic Method Invocation or the ProFTPD mod_copy module buy time, but do not close the finding.
• Hunt for the second stage. Old local privilege escalation bugs matter after a web shell has landed. Alert on service accounts such as www-data, apache or nobody spawning su, sudo or unusual setuid binaries, and on changes to the local passwd file outside of package management.
• Watch the reports that trigger additions. Large joint advisories and vendor threat reports are often followed by KEV additions within days. Checking their CVE lists against your inventory is faster than waiting for the catalog.

Look up any CVE mentioned here with the CVE search for current KEV, EPSS and NVD data. Our weekly summaries of new KEV entries are in the weekly reports.