312-39V2: Certified SOC Analyst v2

During a routine security audit, analysts find that several of the organization’s web servers still use a vulnerable third-party library that has been flagged for a zero-day exploit. The vulnerability was identified in an earlier audit, and patches were initially deployed to reduce the risk. However, because of reported application instability and compatibility issues, the application team rolled back the patches, leaving the systems exposed. Despite the known risk, the vulnerability remains unresolved, and no alternative mitigations have been implemented. Given the condition of the web servers and their dependence on outdated, vulnerable software, how should the security team classify this risk in the context of web application security?