The Backport Myth: We Tried to Prove 624 EOL Versions Were Unpatchable. Vendors Kept Proving Us Wrong.
The security industry runs on a simple story: end of life means no more patches, forever. We set out to catalog the proof — every actively exploited vulnerability affecting an end-of-life version that would never see a fix. We expected a long list. We verified ~98 candidate pairs line-by-line against vendor advisories, and roughly 88% failed — most often because the vendor had quietly patched the "dead" version anyway. This is what the verification actually found: the myth, the receipts, and the short, brutal list of places where unpatchable is real.
The experiment
We maintain two datasets that normally live apart: CISA's Known Exploited Vulnerabilities catalog (what attackers are actually using — 1,600+ entries) and verified end-of-life dates for 500+ products. Crossing them yields 624 candidate (product × CVE) pairs where an exploited vulnerability plausibly touches a version past its end of life. If the conventional wisdom held, most of those pairs should be permanent, unfixable exposure.
Each candidate had to clear four gates, from primary sources only: the CVE is on CISA KEV; the vendor's own advisory lists the end-of-life version as affected; the version is past end of life in our verified data; and the fix shipped only to supported versions. Any patch reaching the EOL line — courtesy fix, paid extended-support build, backport — disqualifies the pair. We worked through the ~98 highest-plausibility candidates by hand.
The result: the myth failed almost 9 times in 10
Roughly 88% of verified candidates were rejected. The reasons form a pattern nobody's slideware mentions:
Vendors backport to "dead" versions constantly. Apache shipped the fix for ActiveMQ's most notorious flaw (CVE-2023-46604) to every end-of-life line. Adobe's Commerce hotfixes for the SessionReaper flaw covered versions past their support dates. Drupal ships "best effort" security fixes to end-of-life lines — CVE-2026-9082's fix reached the dead 9 and 8.9 lines. Fortinet backported its most famous RCE fixes to end-of-life FortiOS 6.0 and 6.2. VMware patched end-of-life vCenter 6.5 and 6.7 for CVE-2023-34048. Even the Equifax-era Struts flaws — the canonical "EOL software kills companies" story — were patched by Apache in the old 2.3 line.
End-of-life dates and final patches coincide by design. SharePoint 2016 and 2019 reached end of life on 2026-07-14 — which was a Patch Tuesday, so both received fixes on their final day. "EOL version" and "unpatched version" are not the same claim, and the gap between them is where careless risk registers go wrong.
Paid channels count as patches. Exchange 2016/2019 continue receiving security updates through paid extended support. A version with a purchasable fix is exposed budget, not exposed infrastructure — our feed excludes it.
Some vendors make the claim unverifiable — which is its own answer. Adobe ColdFusion advisories never list end-of-life versions in their affected tables at all. Under a primary-source gate, "plausibly vulnerable but unverifiable" is an automatic rejection — and a reminder of how much EOL risk assessment runs on inference dressed as fact.
Where unpatchable is real
The ~12% that survived isn't random — it clusters in three specific cultures:
| Cluster | Verified examples | The tell |
|---|---|---|
| Hard-cutoff policy vendors | JetBrains TeamCity (CVE-2026-63077: nine affected lines, fix only in the current two) · Atlassian Confluence (three separate exploited CVEs, EOL lines never fixed) | A published support policy that fix history follows without exceptions |
| Appliance vendors saying the quiet part loudly | Broadcom/VMware ESXi 7.0 × CVE-2024-37085: the advisory states "No Patch Planned" · FortiOS 6.4/7.0 × CVE-2025-68686: remediation reads "Migrate to a fixed release" | Advisory language — the gold standard of proof |
| Single-line open source | Exim 4.91 × CVE-2019-10149 · Apache Solr 5/6/7 × two exploited CVEs · Roundcube 1.2–1.4 · MLflow 2.x × CVE-2026-64849 · Ray below 2.52.0 | No lifecycle policy at all — fixes land in the newest release only, and old versions simply stop existing |
Note what's absent: the giant CMSes, the big web servers, most of the enterprise stack. Generous-backport cultures (Drupal, Adobe, Cisco, Grafana, Zabbix, Apache httpd's 2.4 line) produced zero valid entries. The truly unpatchable concentrates where the vendor has either a hard policy, an appliance business model, or no policy at all. We now publish these as a curated feed, and per-product patch-behavior verdicts with the CVE evidence behind each.
Both wrong lessons, preempted
Wrong lesson #1: "EOL is fine, vendors patch anyway." Courtesy backports are charity with a trend line, and the trend is hardening. Fortinet went from backporting famous RCEs to "migrate to a fixed release" within two years. Apache fixed old ActiveMQ lines for the 2023 flaw and declined for the 2026 one. MLflow's 2.x line — the default for three years — got nothing for a CVSS 9.3 flaw being scanned within hours of disclosure. Charity arrives for catastrophes, sometimes, and you learn whether yours qualified only after the exploit is public.
Wrong lesson #2: "EOL means already compromised." The binary panic reading is equally unsupported. Risk after end of life is a function of the vendor's observed behavior, the version's exploit history, and whether a paid bridge exists — which is why a single date field makes a poor risk register and why we score these factors separately.
The precise statement is this: end of life is the moment patches stop being a promise and start being luck. Some vendors' luck has been generous. Counting on it is not a security posture.
Methodology, so you can check us
Candidates came from crossing CISA's live KEV catalog against verified lifecycle data (624 pairs), worked in batches through the ~98 most plausible. Every published entry cites the KEV record, the vendor advisory, the NVD entry, and the lifecycle page used as evidence. Entries are deleted if a vendor later backports — it has happened, and the deletions are the system working. EPSS probabilities shown on the feed are model output, labeled as such, and never affect inclusion. The full feed is free, as JSON, at endoflife.ai/exploited-and-unpatchable.