NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

Old Windows Video ActiveX flaw CVE-2008-0015 added to CISA’s exploited list; fixes date from 2009

CISA listed an old Windows ActiveX flaw as exploited in February 2026. A malicious page in Internet Explorer can run code on vulnerable systems. Microsoft issued fixes in 2009; replace legacy PCs or ask IT to verify all applicable updates.

What to do

If your family still uses one of these legacy Windows computers, move to a supported system. Until then, stop browsing with Internet Explorer and ask your IT provider to verify MS09-032 (KB973346) and every applicable MS09-037 component update, including its September rerelease.

Check your devices
  • Windows 2000fixed in MS09-032 and all applicable MS09-037 updates and later
  • Windows XPfixed in MS09-032 and all applicable MS09-037 updates, including the September 2009 rerelease and later
  • Windows Vistafixed in All applicable MS09-037 updates, including the September 2009 rerelease and later

What’s happening

CVE-2008-0015 lets a malicious web page run code through vulnerable Windows ActiveX components in Internet Explorer, with the permissions of the person using the computer. Microsoft disclosed the Video control issue in July 2009 and confirmed attacks that month. MS09-032 blocked that control; MS09-037 subsequently repaired Windows components sharing the underlying flaw, with further updates in September. The later bulletin covers Windows 2000, XP, Server 2003, Vista and Server 2008, depending on installed components. This broader scope differs from July’s Video-control bulletin, which identified XP and Server 2003 as vulnerable to that attack route. CISA added the flaw to its exploited catalogue on 17 February 2026. That establishes known exploitation, but does not date a new campaign. As at 3 November, the reviewed sources do not establish who was targeted, when the attacks behind the listing occurred, or whether they continue. Fixes have been available since 2009.

What
Flaw
Affects
Microsoft Windows Video ActiveX Control and related Windows ActiveX components
Affected
Windows 2000 Service Pack 4: affected components listed in MS09-037
Windows XP Service Pack 2 and Service Pack 3
Windows XP Media Center Edition 2005
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2: x86, x64 and Itanium editions
Windows Vista: original release, Service Pack 1 and Service Pack 2, x86 and x64 editions
Windows Server 2008: original release and Service Pack 2, x86, x64 and Itanium editions; component applicability varies, including Server Core
Fixed in
MS09-032: KB973346 blocks the Video ActiveX control in Internet Explorer
MS09-037 (KB973908): applicable component updates KB973354, KB973540, KB973507, KB973869, KB973815 and KB973768, including the September 2009 rerelease
CVE
CVE-2008-0015
Since
17 Feb 2026
Closed
17 Feb 2026

Timeline

  1. CISA added

    CISA added CVE-2008-0015 to its Known Exploited Vulnerabilities catalogue, citing evidence of active exploitation. Its announcement did not identify attackers, victims or attack dates.

  2. New fixFixed

    Microsoft expanded MS09-037 with HtmlInput Object ActiveX updates for Windows XP Media Center Edition 2005 and Windows Vista.

  3. New fixPartly fixed

    MS09-037 addressed the underlying flaw in additional Windows components. Microsoft said this update was needed even where MS09-032 was already installed.

  4. New fixPartly fixed

    Microsoft released MS09-032 (KB973346), blocking the vulnerable Video control from running in Internet Explorer. Microsoft confirmed exploitation; this update did not repair other Windows components containing the same flaw.

  5. Made publicNo fix yet

    Microsoft published advisory 972890 about the Windows Video ActiveX Control vulnerability, CVE-2008-0015.

Sources

  1. Microsoft Security Bulletin MS09-032 — Cumulative Security Update of ActiveX Kill BitsMicrosoft · 14 July 2009
  2. Microsoft Security Bulletin MS09-037 — Vulnerabilities in Microsoft Active Template LibraryMicrosoft · 11 Aug 2009
  3. Microsoft Security Advisory 972890Microsoft · 6 July 2009
  4. MS09-037: Why we are using CVE's already used in MS09-035Microsoft · 11 Aug 2009
  5. CISA Adds Four Known Exploited Vulnerabilities to CatalogCISA · 17 Feb 2026
  6. CVE-2008-0015 DetailNIST · 16 June 2026
  7. CISA Flags Four Security Flaws Under Active Exploitation in Latest KEV UpdateThe Hacker News · 18 Feb 2026
  8. CISA Adds Four Actively Exploited Vulnerabilities to KEV, Urges Immediate RemediationThaiCERT · 19 Feb 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from February 2026 · JSON · RSS