The main site itself was very unlikely to be vulnerable, but support apps, internal apps, etc. are all vectors.