This refers to a vulnerability reported in an operating system (e.g., Windows Server 2008) or a service (e.g., Apache Tomcat) when that version of the system or service is no longer supported. As a result, the system will no longer receive security patches. It is therefore necessary to update the system or service to a version that is actively supported by the vendor.