{"id":"windows-server-service-ms08-067-kev-may-2026","category":"patch","status":"closed","title":"Windows Server service flaw CVE-2008-4250 (MS08-067) added to CISA's list of flaws used in attacks","tldr":"CISA says attackers are using CVE-2008-4250, a 2008 Windows Server service flaw that lets a crafted network request run code. Microsoft fixed it in 2008. Machines that are fully updated are covered; old unpatched Windows (XP, 2000, 2003) are the risk. Update or retire them.","summary":"On 20 May 2026 CISA added CVE-2008-4250 to its list of flaws known to be used in attacks. It is a buffer overflow in the Windows Server service, the part of Windows that handles file and printer sharing over a network. A specially crafted RPC request can let a remote attacker run their own code, and on Windows 2000, XP and Server 2003 no login was needed. Microsoft fixed it on 23 October 2008 in bulletin MS08-067, rating it Critical for those systems and Important for Windows Vista and Server 2008, and warned then that it could be used in a worm. The fix has been available for more than 17 years, so the listing points to old, unpatched or unsupported Windows machines still reachable on a network. CISA's notice does not say who is exploiting it or how widely. No newer vendor guidance was found. Up-to-date supported Windows already has the fix.","action":"Make sure Windows is fully updated, and replace or disconnect any computer still running Windows XP, 2000 or Server 2003, which no longer get updates. Businesses should find old systems on their network and block file-sharing access from the internet.","product":"Microsoft Windows Server service (Windows 2000, XP, Server 2003, Vista, Server 2008)","audience":"both","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2008-4250"],"tags":["microsoft","windows","ms08-067","cisa-kev","exploited","rpc","legacy","remote-code-execution"],"affected":["Windows 2000","Windows XP","Windows Server 2003","Windows Vista","Windows Server 2008"],"fixed":["Security update 958644 (MS08-067), 23 October 2008"],"matches":[],"sources":[{"kind":"advisory","title":"Microsoft Security Bulletin MS08-067 - Critical","url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067","by":"Microsoft","date":"2008-10-23"},{"kind":"advisory","title":"CISA Adds Seven Known Exploited Vulnerabilities to Catalog","url":"https://content.govdelivery.com/accounts/USDHSCISA/bulletins/4182ffb","by":"CISA","date":"2026-05-20"}],"started":"2026-05-20","closed":"2026-05-20","created":"2026-11-03T21:44:02.624Z","updated":"2026-11-03T21:44:02.624Z","cve_notes":[{"cve":"CVE-2008-4250","name":"Buffer overflow in the Windows Server service","what":"A buffer overflow in the Windows Server service, which handles file and printer sharing, that lets a remote attacker run code on the computer by sending it a crafted RPC request.","severity":"critical","cvss":9.8}],"timeline":[{"at":"2026-05-20","added":"2026-11-03T21:41:32.717Z","kind":"cisa-added","text":"CISA added CVE-2008-4250, the Windows buffer overflow, to its Known Exploited Vulnerabilities catalog, one of seven additions that day, on evidence of active exploitation. CISA's notice does not say who is attacking or how many systems are affected.","url":"https://content.govdelivery.com/accounts/USDHSCISA/bulletins/4182ffb","by":"CISA","patch":null},{"at":"2008-10-23","added":"2026-11-03T21:41:32.717Z","kind":"disclosed","text":"Microsoft published bulletin MS08-067 (rated Critical) and a security update for a privately reported flaw in the Windows Server service, saying a crafted RPC request could let an attacker run code without logging in on Windows 2000, XP and Server 2003, and warning it could be used in a worm.","url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067","by":"Microsoft","patch":"patched"}],"url":"https://hard.fyi/live/windows-server-service-ms08-067-kev-may-2026/","json":"https://hard.fyi/api/live?id=windows-server-service-ms08-067-kev-may-2026"}