Known-vulnerable component

What it means

A known-vulnerable component is a library, framework, runtime or container image in your application that carries a publicly documented flaw. A fix exists, and you keep running the old version. The word doing the work is known. Somebody found it, wrote it up and published the details.

Modern applications are mostly other people's code. One service pulls in hundreds of packages, most arriving as dependencies of dependencies, so teams ship components nobody on the team chose.

Why it matters

This is the most predictable way in. An attacker does not need to understand your application or find anything original. They read the advisory, pick up the exploit that usually follows, and look for anyone still on the affected version. CISA publishes a catalogue of vulnerabilities already exploited in the wild, which tells you which ones people are genuinely using.

Customers check this first, because it is the easiest thing to see from outside and the hardest to explain away. MITRE even has CWE-1104 for relying on unmaintained third party components, where no fix is coming at all.

How it shows up

Dependency scanning gives you an inventory, and that inventory always runs longer than anybody expected. The work starts afterwards. Half the alerts sit in code paths you never call, and the urgent one hides in a package you cannot upgrade without a breaking change.

Prioritise on two questions. Can your application actually reach the vulnerable function, and does that component see input from outside? A flaw in a parser handling public uploads is a different matter from the same flaw in a build-time tool nobody can reach.