Microsoft won't patch old Windows Servers, so a small security firm is doing it

[Alfonso Maruccia]

Keep 'Em Patching: 0patch is a "micropatching" service designed to keep aging software secure after its official support period ends. The service, provided by Slovak security company Acros Security, focuses primarily on Windows, as many critical systems continue to run older Windows releases despite Microsoft's efforts to push users toward newer versions.

The 0patch service recently unveiled a new set of patches for several "dead" versions of Windows Server. The updates are designed to address a dangerous security vulnerability Microsoft disclosed in August. Although the flaw has been fixed in supported Windows editions, it remains a threat to older versions that no longer receive official security updates.

As explained by the 0patch team, the new micropatches address CVE-2026-62878, a remote code execution vulnerability in the Windows DNS Server service. Attackers could exploit the flaw remotely to trigger memory corruption, without requiring special privileges or authentication credentials.

Microsoft released a patch for the vulnerability in August 2026, giving security researchers the information needed to develop their own proof-of-concept (PoC) exploits. 0patch credited Nicolas Alejandro Malizia and Joaquín Grassi for developing a PoC for CVE-2026-62878. The company then used it to reproduce the vulnerability and develop patches for legacy Windows systems.

The 0patch fixes follow the same approach Microsoft used to address the vulnerability in August. The Redmond corporation limited the DNS service's "query recursion nesting depth" to 62, preventing the buffer overflow at the heart of CVE-2026-62878. However, 0patch takes a different approach from traditional Windows Update downloads.

Acros' micropatches are "microscopic" updates delivered on the fly while the operating system is running. These updates typically modify just a few CPU instructions, applying fixes for critical vulnerabilities transparently without requiring a reboot or a conventional software update installation.

According to 0patch's alert, the new fixes target the following unsupported Windows Server releases: Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2. These aging server platforms are based on the same core codebases as Windows 7, Windows 8, and Windows 8.1, respectively.

The micropatching team said that "if you're using Windows that aren't receiving official security updates anymore, 0patch will make sure these vulnerabilities won't be exploited on your computers – and you won't even have to know or care about these things."

In recent years, 0patch expanded its support to Windows 10, offering paying customers and organizations five additional years of critical security fixes. Acros has now revealed that several more unsupported Windows releases will soon be added to the 0patch program, starting with Windows 10 version 22H2 enrolled in the first year of Extended Security Updates (ESU), in October 2026.

Permalink to story:

Microsoft won't patch old Windows Servers, so a small security firm is doing it

 

[Squid Surprise]

It’s one thing for home users, but anyone running a server should NOT be using out-of-date software from 2012 (or older)… upgrade please!

 

[maxxcool7421]

It’s one thing for home users, but anyone running a server should NOT be using out-of-date software from 2012 (or older)… upgrade please!

USPS used win 3.11 as recently as 6 years ago.. some apps cant be moved, and wont work as well in a docker

 

[Squid Surprise]

USPS used win 3.11 as recently as 6 years ago.. some apps cant be moved, and wont work as well in a docker

And that was foolish of them… big companies especially have no excuses… they have millions of customers’ data!

 

[Theinsanegamer]

And that was foolish of them… big companies especially have no excuses… they have millions of customers’ data!

That’s not how it works.

1) if the system is not internet connected then WGAF? Run whatever

2) what is there to move to? These systems often do not have any sort of alternative that runs on modern hardware that meets their needs. Welcome to industrial software.

You say it’s foolish but the immense amount of legal cost and pressure if they move from that software and start ****ing up legal documents or medical deliveries would far outstrip maintenance costs.

 

[Squid Surprise]

That’s not how it works.

1) if the system is not internet connected then WGAF? Run whatever

2) what is there to move to? These systems often do not have any sort of alternative that runs on modern hardware that meets their needs. Welcome to industrial software.

You say it’s foolish but the immense amount of legal cost and pressure if they move from that software and start ****ing up legal documents or medical deliveries would far outstrip maintenance costs.

USPS almost certainly WAS connected to the internet… they deliver packages all over the world… and as they’re a multi-billion dollar operation, they should have up-to-date hardware and software.

They aren’t some tinpot company - they’re the US postal service! There are plenty of software companies that can sell them applications that don’t require DOS or Windows 3.1…

 

[Win7user]

"Although the flaw has been fixed in supported Windows editions, it remains a threat to older versions that no longer receive official security updates." <----------- Yeah, because Microsoft want you to spend money upgrading. Greedy, SOS's

 

[StefanTJ]

I'm very curious what happens when they introduce a regression and break something with one of their "microfixes". Microsoft itself does it constantly, and they have the source code and can at least try to prevent this - these guys have public symbols and that's about it. Can't see this ending well for their customers, especially since the systems are supposed to be patched without admin intervention, sight unseen. You just go into work on Monday and there's no DNS resolution anywhere in the company and you can't figure out why - it's because of a "stealth update". Yeah, sounds lovely and fun.

You say it’s foolish but the immense amount of legal cost and pressure if they move from that software and start ****ing up legal documents or medical deliveries would far outstrip maintenance costs.

Wait until you hear about the immense legal, insurance, IT (restores after compromise are expensive!), and reputational costs if they don't do it and end up with a compromised environment because of an unforced error! And with any script kiddie with a Claude Pro sub being able to just spray and pray attack any company with unsecured internet-facing endpoints, it's even more of a given that someone will stumble upon the unlatched vulnerability and wreak havoc - and soon.

"Although the flaw has been fixed in supported Windows editions, it remains a threat to older versions that no longer receive official security updates." <----------- Yeah, because Microsoft want you to spend money upgrading. Greedy, SOS's

Well yes and no. Updating software with gigantic code bases like Windows is hard, and the reality is (or was before AI coding took off?) that they have a fixed amount of engineering hours available. If they pull software engineers off work on innovative features to patch bugs in Windows XP, they don't really stand to make more money by doing that.