341 S&P 500 Companies Are Running Software With a Known Critical CVE Right Now — 330 Have No Bounty Program

We matched live technology fingerprints against our CVE cache across the whole index. Nearly two-thirds of S&P 500 companies have at least one CRITICAL-severity, version-matched vulnerability sitting on public infrastructure. The disclosure-coverage gap our last three reports found holds again — this time on the highest-severity exposure class we track.

NullBlocks Research — August 2026

Our last three reports each found the same shape from a different angle: subdomain-takeover risk, GraphQL introspection, and Wayback-archived legacy pages all concentrate outside the small cluster of companies that already run a bug-bounty program. This report asks the most direct version of that question: not "is there a stale asset" or "is a schema exposed," but "is there software running right now, in production, with a publicly known critical vulnerability attached to the exact version we fingerprinted."

Methodology, up front

domrecon fingerprints the technology stack (server software, JS libraries, frameworks, CMS platforms) behind every subdomain it probes, extracting a version string wherever the target discloses one (a response header, a generator meta tag, a version-specific JS bundle, etc.). We match each versioned detection against a locally cached CVE database (NVD + OSV) built from the same canonical product identifiers, and keep only entries whose affected version range actually covers the detected version — not a bare keyword match. This pass covers all 543 companies currently tracked: 162,483 individual CRITICAL-severity findings, representing 340 distinct CVE IDs, spread across 341 companies.

1. 341 of 543 companies (62.8%) have at least one CRITICAL, version-matched CVE

That's not "ran an old version once" noise — every one of these is a version-range match against a real cached CVE, tied to a technology we actually fingerprinted live on that company's infrastructure. The concentration by underlying technology tells its own story about where the debt actually lives:

This isn't a story about exotic zero-days. It's boring, foundational web infrastructure — web servers, CMS platforms, and front-end libraries — running old enough versions that dozens of already-public CVEs apply directly.

2. It's concentrated in sectors you might not expect

Real Estate (80.6% of companies affected), Materials (76.9%), Utilities (74.2%), and Communication Services (72.7%) all have a higher rate of critical exposure than Information Technology (60.3%) or Financials (68.0% — though Financials' raw count of 51 affected companies is the largest of any sector). The pattern across all four of our reports now: security posture doesn't track industry stereotype. A REIT's marketing site and a utility's customer portal carry the same kind of stale-software debt as anyone else's, with less scrutiny pointed at them.

3. The overlap: 330 of 341 companies (96.8%) have zero HackerOne coverage

This is the fourth time we've run this cross-reference, and the fourth time it's landed in the same place. Of the 341 companies with at least one CRITICAL version-matched CVE, only 11 have any matched HackerOne bounty program: Adobe, Airbnb, Booking Holdings, CrowdStrike, GitHub, Hilton Worldwide, Marriott International, PayPal, Starbucks, Uber, and Wells Fargo — the same small, mature-program cluster our bounty-coverage report first identified. The other 330, including several of the very highest finding-volume companies in this entire dataset, have no HackerOne program at all:

To be clear about a real limitation here: raw finding count is not severity-weighted risk — a company can show a high count because it runs many subdomains on one outdated shared platform (e.g. a CMS instance reused site-wide), not because each finding is independently exploitable. This table is a starting point for investigation, not a ranked "worst company" list. What it does establish reliably: real, version-confirmed critical vulnerability exposure exists broadly, and it does not track with whether a company has a paid disclosure channel.

An honest caveat

This pass only checks HackerOne — Bugcrowd and self-hosted security.txt-only programs aren't in this cross-reference yet, so treat "no H1 coverage" as "no H1 program found," not "no path to responsibly disclose at all." A version-matched CVE also isn't automatic proof of exploitability — network position, WAF rules, and patch backports outside the version string can all change the real picture. This is a signal for where to look, not a confirmed finding you can report as-is.

What this means if you hunt bug bounties

1. A big raw CVE count is a research lead, not a payday by itself. Confirm the finding is real and exploitable before assuming it's reportable anywhere.
2. Check security.txt and Bugcrowd before writing a company off — this pass is H1-only, same caveat as our last three reports.
3. The concentration by technology (jQuery, nginx, WordPress, Apache) tells you where to look first across almost any target in this sector spread — these are commodity platforms, not obscure internal tooling, so public exploit writeups and known attack chains already exist for many of the underlying CVEs.
4. This is now a four-for-four pattern across independent exposure classes (subdomain takeover, GraphQL introspection, Wayback legacy pages, and now version-matched critical CVEs). If you're deciding where to spend hunting time, "companies outside the ~15-name mature-program cluster" is consistently where the S&P 500's real, unaddressed technical risk sits.

Check your own footprint

Everything above came from the same free tool anyone can run right now: domrecon.com — enter a domain, get a plain-English risk grade, version-matched CVEs, full technology stack, and live subdomain inventory, including whether we've matched it to a known bug-bounty program. No signup required.

If you want the aggregate, cross-company view instead of one domain at a time — the kind of query that produced this report — that's what we built next: Graph Explorer, continuous scanning of the S&P 500's public attack surface as one interactive graph. See what's in it →

Data as of 2026-08-19, one point-in-time snapshot from our CVE-matching pipeline and nightly HackerOne sync — not continuous monitoring. Spot an error, or want the underlying query for a specific company? Reply — we read every message.

NullBlocks Systems — domrecon attack-surface intelligence.