Six Months !?! If I'd left a vulnerability like that open for 6 hours there'd be hell to pay. Something that critical is call for hitting the big red off button.
In this case the CEO was aware of it and... did nothing.
Ah, see, if the CEO does something that hurts the company it's ok. In fact, they will pay him (or her) for making the mistake in the form of a golden parachute. It's only the rank and file employees that actually suffer consequences from failures.