diff --git a/changes/15213-vuln-enabled b/changes/15213-vuln-enabled
new file mode 100644
index 0000000000..8b4b64b546
--- /dev/null
+++ b/changes/15213-vuln-enabled
@@ -0,0 +1 @@
+- Fixes a bug that caused vulnerability scanning status to be misreported in analytics.
\ No newline at end of file
diff --git a/server/datastore/mysql/statistics.go b/server/datastore/mysql/statistics.go
index 39d77d86e8..85af770b13 100644
--- a/server/datastore/mysql/statistics.go
+++ b/server/datastore/mysql/statistics.go
@@ -81,7 +81,7 @@ func (ds *Datastore) ShouldSendStatistics(ctx context.Context, frequency time.Du
 		stats.NumPolicies = amountPolicies
 		stats.NumLabels = amountLabels
 		stats.SoftwareInventoryEnabled = appConfig.Features.EnableSoftwareInventory
-		stats.VulnDetectionEnabled = appConfig.VulnerabilitySettings.DatabasesPath != ""
+		stats.VulnDetectionEnabled = config.Vulnerabilities.DatabasesPath != "" || appConfig.VulnerabilitySettings.DatabasesPath != ""
 		stats.SystemUsersEnabled = appConfig.Features.EnableHostUsers
 		stats.HostsStatusWebHookEnabled = appConfig.WebhookSettings.HostStatusWebhook.Enable
 		stats.MDMMacOsEnabled = appConfig.MDM.EnabledAndConfigured
diff --git a/server/datastore/mysql/statistics_test.go b/server/datastore/mysql/statistics_test.go
index 33eb3b11cd..0dd5a97b99 100644
--- a/server/datastore/mysql/statistics_test.go
+++ b/server/datastore/mysql/statistics_test.go
@@ -145,8 +145,8 @@ func testStatisticsShouldSend(t *testing.T, ds *Datastore) {
 	})
 	require.NoError(t, err)
 
-	// Create new app config for test
-	config, err := ds.NewAppConfig(ctx, &fleet.AppConfig{
+	// Create new app cfg for test
+	cfg, err := ds.NewAppConfig(ctx, &fleet.AppConfig{
 		OrgInfo: fleet.OrgInfo{
 			OrgName:    "Test",
 			OrgLogoURL: "localhost:8080/logo.png",
@@ -168,15 +168,15 @@ func testStatisticsShouldSend(t *testing.T, ds *Datastore) {
 	require.NoError(t, err)
 
 	require.NoError(t, err)
-	config.Features.EnableSoftwareInventory = false
-	config.Features.EnableHostUsers = false
-	config.VulnerabilitySettings.DatabasesPath = ""
-	config.WebhookSettings.HostStatusWebhook.Enable = true
-	config.MDM.EnabledAndConfigured = true
-	config.HostExpirySettings.HostExpiryEnabled = true
-	config.MDM.WindowsEnabledAndConfigured = true
-	config.ServerSettings.LiveQueryDisabled = true
-	err = ds.SaveAppConfig(ctx, config)
+	cfg.Features.EnableSoftwareInventory = false
+	cfg.Features.EnableHostUsers = false
+	cfg.VulnerabilitySettings.DatabasesPath = ""
+	cfg.WebhookSettings.HostStatusWebhook.Enable = true
+	cfg.MDM.EnabledAndConfigured = true
+	cfg.HostExpirySettings.HostExpiryEnabled = true
+	cfg.MDM.WindowsEnabledAndConfigured = true
+	cfg.ServerSettings.LiveQueryDisabled = true
+	err = ds.SaveAppConfig(ctx, cfg)
 	require.NoError(t, err)
 
 	time.Sleep(1100 * time.Millisecond) // ensure the DB timestamp is not in the same second
@@ -364,4 +364,10 @@ func testStatisticsShouldSend(t *testing.T, ds *Datastore) {
 	assert.Equal(t, firstIdentifier, stats.AnonymousIdentifier)
 	assert.Equal(t, "free", stats.LicenseTier)
 	assert.Equal(t, "unknown", stats.Organization)
+
+	fleetConfig.Vulnerabilities = config.VulnerabilitiesConfig{DatabasesPath: "some/path/vulns"}
+	stats, shouldSend, err = ds.ShouldSendStatistics(license.NewContext(ctx, freeLicense), time.Millisecond, fleetConfig)
+	require.NoError(t, err)
+	assert.True(t, shouldSend)
+	assert.True(t, stats.VulnDetectionEnabled)
 }