An unpatched server is a system that is still running software with a known security flaw because the vendor fix has not been installed. In practice, that means the server may be exposed to attacks that defenders already know how to stop, but have not yet closed.
Unpatched servers matter because attackers often scan for them soon after a vulnerability becomes public or a proof of concept appears. Once found, they can be used for initial access, privilege escalation, or remote code execution, especially in internet-facing services. Defenders reduce this risk by tracking asset versions, applying updates quickly, and verifying that patching actually succeeded. Where immediate patching is not possible, compensating controls such as restricting exposure, disabling vulnerable features, and monitoring for suspicious activity help limit abuse.