#legacy-systems

Analysis · May 10, 2026 · analysis-desk

The seven-year gap is the story, not the CVE

Microsoft patched CVE-2018-8639 in December 2018. CISA added it to the KEV catalog in March 2025. The interesting number isn't the bug's age — it's the distance between when a fix shipped and when the exposed fleet was acknowledged.