PCI DSS Compliance : Security End of Life Software

Tenable plugin 176329 is not a vulnerability — it's a PCI DSS compliance check that flags software past its vendor-declared *End of Life* or *End of Support* date. The plugin enumerates installed packages, services, OS builds, and middleware (think Windows Server 2012 R2, RHEL 6, Apache 2.2, PHP 5.x, OpenSSL 1.0.2, Java 6/7/8 pre-Oracle, MySQL 5.5/5.6, Node 12/14, .NET Framework <4.6.2, etc.) and compares them against lifecycle databases. There are no CVE IDs attached — the finding is categorical: the vendor has stopped issuing security patches for this artifact, so any future flaw is permanently unpatched on this host.

Tenable scores this MEDIUM because, on a given scan day, there may be no *known unpatched* RCE against the EOL product. That severity is wrong for the PCI context this plugin lives in. PCI DSS Requirement 6.3.3 treats unsupported software as a *critical* control gap: it converts the host into a permanent exception that must be compensated, documented, and re-justified annually. Combined with the realistic threat picture — EOL OS/middleware are the highest-yield ransomware footholds of 2024-2026 (Akira, Black Basta, Cl0p all preference EOL boxes) — this is a HIGH finding on any in-scope CDE asset.

Why this verdict

• Categorical patch-gap: unlike a normal CVE, there is no fix coming — ever. Future zero-days against this artifact are permanently unmitigated.
• Role multiplier: the plugin overwhelmingly fires on OS, web server, runtime, and database tiers — canonical high-value-role components. A compromised EOL Windows Server in a CDE ends in domain or cardholder-data compromise; the high-value-role floor is HIGH.
• Compliance multiplier: PCI 6.3.3 requires documented compensating controls and annual risk acceptance. An unremediated finding here is an audit-grade defect, not a hygiene item.
• Threat-intel multiplier: Mandiant, Coveware, and Sophos 2025 reports all rank EOL OS/middleware as the top ransomware initial-access enabler — far above phishing for confirmed breaches in retail/hospitality (PCI verticals).
• Friction adjustment: the finding may fire on isolated lab hosts or out-of-scope dev boxes — those instances can be downgraded individually with documented scope evidence, but the default posture is HIGH.

Why not higher?

Not CRITICAL because the plugin itself is not weaponized exploitation — it's a state observation. Individual hosts may be isolated, behind segmentation, or covered by paid extended support (Microsoft ESU, Red Hat ELS, Ubuntu ESM) that materially changes the patch story. Without a paired KEV-listed CVE on the same host, the chain is not yet active.

Why not lower?

Not MEDIUM because the artifact will never be patched again, the host is by plugin-definition in a PCI compliance frame, and EOL stacks dominate ransomware case data. Treating this as a low-urgency finding has been a repeatable root cause in breach post-mortems across 2024-2026.

1. Inventory and tag every EOL artifact this week — You cannot mitigate what you cannot enumerate. Pull the plugin output from Tenable.sc / Tenable.io, join against your CMDB, and tag each host with eol_artifact, pci_scope, and business_owner. Deadline: within 7 days as a HIGH-class finding (noisgate mitigation SLA = 30 days, but inventory is step zero).
2. Subscribe to paid extended support where it exists — Microsoft ESU (Windows Server 2012R2 through Oct 2026, 2008R2 retired), Red Hat ELS (RHEL 6 / 7), Canonical Ubuntu Pro / ESM, TuxCare ELS, and Oracle Sustaining Support buy you continued CVE patches. Within the noisgate mitigation SLA of 30 days — purchase, deploy the ESU keys/repos, and document.
3. Network-segment and front-end with a reverse proxy / WAF — If you cannot retire the host, put it behind a WAF (modern TLS termination, request normalization) and a hard segmentation boundary so EOL TLS/HTTP stacks are never directly reachable. Apply NIST SP 800-82 / PCI 1.3 microsegmentation patterns. Complete within 30 days.
4. Disable unneeded EOL services and harden surface — Turn off SMBv1, legacy TLS ciphers, anonymous binds, default accounts, and any non-essential listener on EOL hosts. Use vendor hardening guides (CIS Benchmarks for the closest supported version) as a baseline.
5. Apply application-layer allowlisting — Deploy AppLocker / WDAC on Windows EOL or SELinux enforcing + fapolicyd on Linux EOL to prevent execution of attacker-introduced binaries. This is the single highest-yield control on a host that will never be patched.
6. Increase EDR sensitivity on EOL hosts — Tune EDR to high-aggression mode on every host flagged by 176329, with priority alerting routed to the SOC on-call. EDR is the last meaningful layer when the OS will never ship a fix.
7. Plan and budget retirement / re-platforming — Execute the noisgate remediation SLA — replace or upgrade within 180 days for HIGH. For PCI hosts, calendar this against your next QSA assessment so it doesn't become a recurring audit finding.

Run on a Windows target host (or fan out via remoting / Tanium / SCCM). Invoke from an elevated PowerShell session: powershell -ExecutionPolicy Bypass -File .\Check-EOL.ps1. Requires local administrator to read OS build and full installed-software inventory. Outputs VULNERABLE, PATCHED, or UNKNOWN.

#requires -Version 3.0
# Check-EOL.ps1 — noisgate verifier for Tenable plugin 176329 (EOL software)
# Exits 1 = VULNERABLE (EOL detected), 0 = PATCHED (supported), 2 = UNKNOWN

$ErrorActionPreference = 'SilentlyContinue'
$findings = @()

# --- OS lifecycle check -------------------------------------------------
$os = Get-CimInstance Win32_OperatingSystem
$caption = $os.Caption
$build   = [int]($os.BuildNumber)

# Microsoft lifecycle cutoffs (mainstream EOL; ESU may extend)
$eolMap = @{
    'Windows 7'              = '2020-01-14'
    'Windows 8'              = '2016-01-12'
    'Windows 8.1'            = '2023-01-10'
    'Server 2008'            = '2020-01-14'
    'Server 2008 R2'         = '2020-01-14'
    'Server 2012'            = '2023-10-10'
    'Server 2012 R2'         = '2023-10-10'
}
foreach ($k in $eolMap.Keys) {
    if ($caption -match [regex]::Escape($k)) {
        $findings += "OS EOL: $caption (vendor EOL $($eolMap[$k]))"
    }
}

# --- .NET Framework -----------------------------------------------------
$ndp = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full' -ErrorAction SilentlyContinue
if ($ndp -and $ndp.Release -lt 394802) {
    $findings += ".NET Framework < 4.6.2 (Release $($ndp.Release)) — EOL 2022-04-26"
}

# --- Installed software scan -------------------------------------------
$paths = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)
$installed = Get-ItemProperty $paths | Where-Object DisplayName

$badPatterns = @(
    @{Name='Java 6';        Re='Java\(TM\) 6|Java SE 6'},
    @{Name='Java 7';        Re='Java\(TM\) 7|Java SE 7'},
    @{Name='Java 8 (Oracle public EOL)'; Re='Java 8 Update'},
    @{Name='PHP 5.x';       Re='PHP 5\.'},
    @{Name='PHP 7.x';       Re='PHP 7\.'},
    @{Name='Python 2.7';    Re='Python 2\.7'},
    @{Name='Node 12/14/16'; Re='Node\.js.*v(12|14|16)\.'},
    @{Name='OpenSSL 1.0.x'; Re='OpenSSL 1\.0\.'},
    @{Name='Apache 2.2';    Re='Apache.*2\.2\.'},
    @{Name='Tomcat 7/8';    Re='Apache Tomcat (7|8)\.'}
)
foreach ($p in $badPatterns) {
    $hit = $installed | Where-Object { $_.DisplayName -match $p.Re }
    if ($hit) { $findings += "EOL package: $($p.Name) — $($hit.DisplayName -join ', ')" }
}

# --- Verdict ------------------------------------------------------------
if ($findings.Count -gt 0) {
    Write-Output 'VULNERABLE'
    $findings | ForEach-Object { Write-Output "  - $_" }
    exit 1
} elseif (-not $os) {
    Write-Output 'UNKNOWN'
    exit 2
} else {
    Write-Output 'PATCHED'
    exit 0
}

Sources

1. Tenable Plugin 176329 — PCI DSS Compliance: Security End of Life Software
2. PCI DSS v4.0.1 Requirements (Requirement 6.3.3)
3. Microsoft Product Lifecycle
4. endoflife.date — community lifecycle database
5. Red Hat Enterprise Linux Life Cycle
6. Ubuntu Pro / Expanded Security Maintenance
7. CISA Known Exploited Vulnerabilities Catalog
8. Mandiant M-Trends 2025