A legacy vulnerability is a security weakness that remains hidden in older code for a long time, sometimes for years, before anyone notices and fixes it. These flaws often survive in mature systems because the code still works, the risky path is rarely exercised, or the bug was introduced before modern testing and review practices were in place.
In cyber security, legacy vulnerabilities matter because age does not reduce risk: an old defect can still be exploitable in current software if the vulnerable feature is reachable. Attackers look for these weaknesses in browsers, operating systems, and enterprise applications, especially where old parsing, memory-handling, or protocol code has not been re-audited. Defenders reduce the danger with code review, vulnerability scanning, rapid patching, and browser or system hardening, but the most important control is finding and removing the flaw before attackers do.