CVE-2014-4114

A 2014 Windows OLE remote code execution flaw was actively exploited in the wild, proving that years-old unpatched vulnerabilities remain a critical threat.

Microsoft Windows OLE allowed remote code execution if a user opened a specially crafted file, and this flaw was listed in CISA's KEV catalog as actively exploited. DIB organizations must care because unpatched, known vulnerabilities are a primary attack vector for ransomware and data breaches, and relying on legacy systems without patching is a severe compliance failure under NIST 800-171. The takeaway is to aggressively patch known CVEs and avoid running outdated Windows versions.

Shame score — A known, unpatched vulnerability from 2014 was actively exploited in the wild, demonstrating severe negligence in patch management and reliance on legacy systems.