There can be many occurrences where vulnerabilities on server instances can go unpatched for quite a while. This can be especially true if the server hosts an application that is so critical, the server team cannot migrate the application to a supported operating system such as anything post Windows 2008 R2. Rarely in our times do critical vulnerabilities get disclosed that we don't see malware that exploits such vulnerabilities. By leveraging the any to any flat network connectivity "wormable malware" as this article suggests can use that connectivity to propagate quickly taking many security architects off guard.
This all reminds me of the days back in 2003 where a single packet attack and infect worm called SQL Slammer propagated across machines within minutes. If you read this article, you will see Slammer infected 75,000 victims within 15 minutes. This piece of malware clearly took advantage of the any to any connectivity in many data centers. If you separate and isolate crown jewel applications in the form of segmentation as part of a greater zero trust approach, you can implement a smaller blast radius of attacks that could exploit a vulnerability like this.
Microsoft today finally released software updates to patch a recently disclosed very dangerous vulnerability in SMBv3 protocol that could let attackers launch wormable malware, which can propagate itself from one vulnerable computer to another automatically