⚠️ 87% of Organizations Running Software with Known Vulnerabilities, Study Finds
Modern development teams are shipping code faster than ever.
AI-assisted coding, automated pipelines, and rapid dependency updates have dramatically accelerated software delivery.
But speed comes with a cost.
A new 2026 State of DevSecOps report reveals that 87% of organizations are currently running services with known exploitable vulnerabilities.
The findings highlight a growing tension between development velocity and security maturity, especially across modern software supply chains.
📊 The Vulnerability Reality
The report analyzed global development pipelines and uncovered a troubling trend:
Known vulnerabilities are present in 40% of deployed services.
Certain programming ecosystems appear more vulnerable than others.
Applications built with Java show the highest exposure, with 59% of services containing known vulnerabilities.
Other platforms also face significant risk:
.NET frameworks
Rust environments
JavaScript and Python dependency chains
While these vulnerabilities are often already documented, many remain unpatched in production systems.
🧨 End-of-Life Software Still Running in Production
Another major concern uncovered in the study is the use of end-of-life runtime environments.
About 10% of global services still run on unsupported software.
Some of the most affected ecosystems include:
Go environments — 23% running EOL versions
PHP environments — 13% running EOL versions
End-of-life software no longer receives security updates, meaning any newly discovered vulnerability can remain permanently exploitable.
⏳ Dependency Updates Are Falling Behind
Even when teams intend to patch vulnerabilities, maintenance delays create new exposure.
The report found that the median third-party dependency is nearly 278 days behind the latest major release.
Languages with the largest update gaps include:
Java
Ruby
These delays often occur because teams fear breaking production systems with major updates.
However, the longer dependencies remain outdated, the greater the attack surface becomes.
⚡ The Other Extreme: Updating Too Fast
Ironically, some teams create risk by moving too quickly.
Nearly half of all organizations install new third-party libraries within 24 hours of release.
Specifically:
54% of JavaScript developers install updates immediately
55% of Python developers adopt new releases within a day
While rapid patching sounds beneficial, it also exposes organizations to malicious package attacks.
Recent examples include malware campaigns such as:
s1ngularity npm worm
Shai-Hulud malicious packages
Attackers frequently publish compromised packages that appear legitimate during the first hours after release.
☁️ Cloud Infrastructure Risks
The study also examined cloud deployment practices.
Many organizations deploy new infrastructure images without security validation.
The findings show:
32% of organizations deploy public Docker images within 24 hours
12% deploy new Amazon Machine Images (AMIs) within a day
Using newly published public images without inspection can expose organizations to hidden backdoors or misconfigurations.
🔧 CI/CD Pipelines: A Hidden Weak Point
Continuous integration pipelines are another major attack surface.
While every surveyed organization uses GitHub Marketplace actions, most fail to lock those dependencies properly.
The report found that 71% of organizations do not pin GitHub actions to a specific commit hash.
Instead, they reference floating versions.
This creates a dangerous scenario.
If an attacker compromises a GitHub action repository, malicious updates can be pushed into thousands of pipelines automatically.
🧠 Alert Fatigue Is Making Things Worse
Security teams often face overwhelming vulnerability alerts.
However, the study reveals something surprising.
When vulnerabilities are evaluated in runtime context, only 18% of “critical” dependency alerts are truly exploitable.
For example:
98% of .NET vulnerabilities are downgraded after analysis
49% of PHP vulnerabilities remain critical
This demonstrates why contextual vulnerability management is essential.
Not every CVE poses real risk to production systems.
🛡 How Organizations Can Reduce Risk
Balancing security with development speed requires smarter processes.
Recommended strategies include:
1️⃣ Implement Dependency Cooldown Periods
Delay adoption of new libraries long enough to detect malicious packages.
2️⃣ Secure CI/CD Pipelines
Pin GitHub actions to full commit SHA values to prevent malicious updates.
3️⃣ Prioritize Exploitable Vulnerabilities
Focus remediation efforts on vulnerabilities that are actually reachable in production.
4️⃣ Monitor Software Supply Chains
Track dependency changes, package updates, and third-party code sources.
🎯 Security Takeaway
Modern software development depends heavily on open-source ecosystems and automated pipelines.
But these same tools have become prime targets for attackers.
The challenge isn’t just patching vulnerabilities.
It’s managing update speed, dependency trust, and supply chain risk simultaneously.
Organizations that build secure development pipelines today will be far better prepared for tomorrow’s threats.
Because in cybersecurity, the real danger isn’t just a vulnerability.
