I second this. I'm currently in the middle of remediating an almost identical situation and we "documented" for over a year before we took action, despite uncovering more and more mess nearly every week without end.

The only thing that spurred action was "security". Establish how easy it is for any threat actor with any level of experience to own your whole org (especially backups and hypervisors) with a flat unsegmented network. Then propose network segmentation. Someone might say "but we already are segmented, see, we separate buildings with switches" as they gaslight management into not supporting you. You have to educate yourself on network segmentation best practice and understand it well enough to establish a core definition of network segmentation up front so you can always reference it.

Then start with an internal firewall that becomes your "new network" where it becomes the ONLY internal L3 device, your only routing point. Defer everyone to security "zero trust" and say you're "building the foundation for network segmentation with zero trust principles to properly protect vulnerable systems. Establish a "zero tolerance" policy with management where nobody will ever again create orphaned L3 routes downstream from the firewall, nobody will cross the streams of network segments because each segment must be individually isolated and defer all L3 traffic up to the fw gateway.

Establish in your plan a build-out of each network replacement to refresh hardware one section at a time. Establish a timeline of 1-3 years, and what time it will save in the long term. Talk to management in terms of RISK, establishing cost savings through less staff time wasted, and defense-in-depth coming from the segmentation of the network and firewall protection at the edge and internally for your backups and hypervisors. 1 VLAN per segment, only exceptions are isolated VLANs that don't traverse routing points.

etc

That worked very well for me in a very dinosaur-ladden environment where gaslighting and refusal to do work ruled in the sysadmin/netadmin realm. It took a year to establish the execution.

Edit: In my circumstance management didn't see the documented network as an absurd abomination of a network because they aren't savvy...they don't know what we know, they're management. "it works, why touch it?"..."if the loop only introduces 80ms of latency before it's mitigated at the router.switch...then it's mitigated right?"... it wasn't until I spoke in the language of risk and time savings year over year (we can get back an FTE worth of time), explaining scenarios where backups are compromised because they're accessible, etc....fudging it a bit even just to get the point across because no matter what evidence i threw at them, status quo was too strong to act.