“Critical vulnerability found in 2014”