[g051051]

The initial vulnerability was in the "modern" web application that fronted the legacy mainframe application. It was completely patchable, but was missed as described in the article.

[b112]

A little bird told me otherwise.