Windows Server service flaw CVE-2008-4250 (MS08-067) added to CISA's list of flaws used in attacks
CISA says attackers are using CVE-2008-4250, a 2008 Windows Server service flaw that lets a crafted network request run code. Microsoft fixed it in 2008. Machines that are fully updated are covered; old unpatched Windows (XP, 2000, 2003) are the risk. Update or retire them.
Make sure Windows is fully updated, and replace or disconnect any computer still running Windows XP, 2000 or Server 2003, which no longer get updates. Businesses should find old systems on their network and block file-sharing access from the internet.
What’s happening
On 20 May 2026 CISA added CVE-2008-4250 to its list of flaws known to be used in attacks. It is a buffer overflow in the Windows Server service, the part of Windows that handles file and printer sharing over a network. A specially crafted RPC request can let a remote attacker run their own code, and on Windows 2000, XP and Server 2003 no login was needed. Microsoft fixed it on 23 October 2008 in bulletin MS08-067, rating it Critical for those systems and Important for Windows Vista and Server 2008, and warned then that it could be used in a worm. The fix has been available for more than 17 years, so the listing points to old, unpatched or unsupported Windows machines still reachable on a network. CISA's notice does not say who is exploiting it or how widely. No newer vendor guidance was found. Up-to-date supported Windows already has the fix.
- What
- Flaw
- Affects
- Microsoft Windows Server service (Windows 2000, XP, Server 2003, Vista, Server 2008)
- Affected
- Windows 2000
Windows XP
Windows Server 2003
Windows Vista
Windows Server 2008 - Fixed in
- Security update 958644 (MS08-067), 23 October 2008
- Since
- 20 May 2026
- Closed
- 20 May 2026
Timeline
- CISA added
CISA added CVE-2008-4250, the Windows buffer overflow, to its Known Exploited Vulnerabilities catalog, one of seven additions that day, on evidence of active exploitation. CISA's notice does not say who is attacking or how many systems are affected.
- Made publicFixed
Microsoft published bulletin MS08-067 (rated Critical) and a security update for a privately reported flaw in the Windows Server service, saying a crafted RPC request could let an attacker run code without logging in on Windows 2000, XP and Server 2003, and warning it could be used in a worm.
Sources
- Microsoft Security Bulletin MS08-067 - CriticalMicrosoft · 23 Oct 2008
- CISA Adds Seven Known Exploited Vulnerabilities to CatalogCISA · 20 May 2026