{"id":"windows-video-activex-exploited-feb-2026","category":"patch","status":"closed","title":"Old Windows Video ActiveX flaw CVE-2008-0015 added to CISA’s exploited list; fixes date from 2009","tldr":"CISA listed an old Windows ActiveX flaw as exploited in February 2026. A malicious page in Internet Explorer can run code on vulnerable systems. Microsoft issued fixes in 2009; replace legacy PCs or ask IT to verify all applicable updates.","summary":"CVE-2008-0015 lets a malicious web page run code through vulnerable Windows ActiveX components in Internet Explorer, with the permissions of the person using the computer. Microsoft disclosed the Video control issue in July 2009 and confirmed attacks that month. MS09-032 blocked that control; MS09-037 subsequently repaired Windows components sharing the underlying flaw, with further updates in September. The later bulletin covers Windows 2000, XP, Server 2003, Vista and Server 2008, depending on installed components. This broader scope differs from July’s Video-control bulletin, which identified XP and Server 2003 as vulnerable to that attack route. CISA added the flaw to its exploited catalogue on 17 February 2026. That establishes known exploitation, but does not date a new campaign. As at 3 November, the reviewed sources do not establish who was targeted, when the attacks behind the listing occurred, or whether they continue. Fixes have been available since 2009.","action":"If your family still uses one of these legacy Windows computers, move to a supported system. Until then, stop browsing with Internet Explorer and ask your IT provider to verify MS09-032 (KB973346) and every applicable MS09-037 component update, including its September rerelease.","product":"Microsoft Windows Video ActiveX Control and related Windows ActiveX components","audience":"both","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2008-0015"],"tags":["microsoft","windows","activex","internet-explorer","remote-code-execution","exploited"],"affected":["Windows 2000 Service Pack 4: affected components listed in MS09-037","Windows XP Service Pack 2 and Service Pack 3","Windows XP Media Center Edition 2005","Windows XP Professional x64 Edition Service Pack 2","Windows Server 2003 Service Pack 2: x86, x64 and Itanium editions","Windows Vista: original release, Service Pack 1 and Service Pack 2, x86 and x64 editions","Windows Server 2008: original release and Service Pack 2, x86, x64 and Itanium editions; component applicability varies, including Server Core"],"fixed":["MS09-032: KB973346 blocks the Video ActiveX control in Internet Explorer","MS09-037 (KB973908): applicable component updates KB973354, KB973540, KB973507, KB973869, KB973815 and KB973768, including the September 2009 rerelease"],"matches":[{"platform":"windows","app":"Windows 2000","bundle":"","fixed":"MS09-032 and all applicable MS09-037 updates"},{"platform":"windows","app":"Windows XP","bundle":"","fixed":"MS09-032 and all applicable MS09-037 updates, including the September 2009 rerelease"},{"platform":"windows","app":"Windows Vista","bundle":"","fixed":"All applicable MS09-037 updates, including the September 2009 rerelease"}],"sources":[{"kind":"advisory","title":"Microsoft Security Bulletin MS09-032 — Cumulative Security Update of ActiveX Kill Bits","url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-032","by":"Microsoft","date":"2009-07-14"},{"kind":"advisory","title":"Microsoft Security Bulletin MS09-037 — Vulnerabilities in Microsoft Active Template Library","url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-037","by":"Microsoft","date":"2009-08-11"},{"kind":"advisory","title":"Microsoft Security Advisory 972890","url":"https://learn.microsoft.com/en-us/security-updates/securityadvisories/2009/972890","by":"Microsoft","date":"2009-07-06"},{"kind":"post","title":"MS09-037: Why we are using CVE's already used in MS09-035","url":"https://www.microsoft.com/en-us/msrc/blog/2009/08/ms09-037-why-we-are-using-cves-already-used-in-ms09-035","by":"Microsoft","date":"2009-08-11"},{"kind":"advisory","title":"CISA Adds Four Known Exploited Vulnerabilities to Catalog","url":"https://content.govdelivery.com/accounts/USDHSCISA/bulletins/40a4268","by":"CISA","date":"2026-02-17"},{"kind":"advisory","title":"CVE-2008-0015 Detail","url":"https://nvd.nist.gov/vuln/detail/cve-2008-0015","by":"NIST","date":"2026-06-16"},{"kind":"news","title":"CISA Flags Four Security Flaws Under Active Exploitation in Latest KEV Update","url":"https://thehackernews.com/2026/02/cisa-flags-four-security-flaws-under.html","by":"The Hacker News","date":"2026-02-18"},{"kind":"news","title":"CISA Adds Four Actively Exploited Vulnerabilities to KEV, Urges Immediate Remediation","url":"https://www.thaicert.or.th/en/2026/02/19/cisa-adds-four-actively-exploited-vulnerabilities-to-kev-urges-immediate-remediation/","by":"ThaiCERT","date":"2026-02-19"}],"started":"2026-02-17","closed":"2026-02-17","created":"2026-11-03T22:05:16.111Z","updated":"2026-11-03T22:05:16.111Z","cve_notes":[{"cve":"CVE-2008-0015","name":"Code execution in Windows Video ActiveX and ATL components","what":"A memory-handling flaw in Windows’ private Active Template Library, used by the Video ActiveX control and other components, can let a malicious web page run code with the user's permissions.","severity":"critical","cvss":8.8}],"timeline":[{"at":"2026-02-17","added":"2026-11-03T22:00:26.134Z","kind":"cisa-added","text":"CISA added CVE-2008-0015 to its Known Exploited Vulnerabilities catalogue, citing evidence of active exploitation. Its announcement did not identify attackers, victims or attack dates.","url":"https://content.govdelivery.com/accounts/USDHSCISA/bulletins/40a4268","by":"CISA","patch":null},{"at":"2009-09-08","added":"2026-11-03T22:00:26.134Z","kind":"new-fix","text":"Microsoft expanded MS09-037 with HtmlInput Object ActiveX updates for Windows XP Media Center Edition 2005 and Windows Vista.","url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-037","by":"Microsoft","patch":"patched"},{"at":"2009-08-11","added":"2026-11-03T22:00:26.134Z","kind":"new-fix","text":"MS09-037 addressed the underlying flaw in additional Windows components. Microsoft said this update was needed even where MS09-032 was already installed.","url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-037","by":"Microsoft","patch":"partial"},{"at":"2009-07-14","added":"2026-11-03T22:00:26.134Z","kind":"new-fix","text":"Microsoft released MS09-032 (KB973346), blocking the vulnerable Video control from running in Internet Explorer. Microsoft confirmed exploitation; this update did not repair other Windows components containing the same flaw.","url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-032","by":"Microsoft","patch":"partial"},{"at":"2009-07-06","added":"2026-11-03T22:00:26.134Z","kind":"disclosed","text":"Microsoft published advisory 972890 about the Windows Video ActiveX Control vulnerability, CVE-2008-0015.","url":"https://learn.microsoft.com/en-us/security-updates/securityadvisories/2009/972890","by":"Microsoft","patch":"none"}],"url":"https://hard.fyi/live/windows-video-activex-exploited-feb-2026/","json":"https://hard.fyi/api/live?id=windows-video-activex-exploited-feb-2026"}