Keep 'Em Patching: 0patch is a "micropatching" service designed to keep aging software secure after its official support period ends. The service, provided by Slovak security company Acros Security, focuses primarily on Windows, as many critical systems continue to run older Windows releases despite Microsoft's efforts to push users toward newer versions.
The 0patch service recently unveiled a new set of patches for several "dead" versions of Windows Server. The updates are designed to address a dangerous security vulnerability Microsoft disclosed in August. Although the flaw has been fixed in supported Windows editions, it remains a threat to older versions that no longer receive official security updates.
As explained by the 0patch team, the new micropatches address CVE-2026-62878, a remote code execution vulnerability in the Windows DNS Server service. Attackers could exploit the flaw remotely to trigger memory corruption, without requiring special privileges or authentication credentials.
Microsoft released a patch for the vulnerability in August 2026, giving security researchers the information needed to develop their own proof-of-concept (PoC) exploits. 0patch credited Nicolas Alejandro Malizia and Joaquín Grassi for developing a PoC for CVE-2026-62878. The company then used it to reproduce the vulnerability and develop patches for legacy Windows systems.
The 0patch fixes follow the same approach Microsoft used to address the vulnerability in August. The Redmond corporation limited the DNS service's "query recursion nesting depth" to 62, preventing the buffer overflow at the heart of CVE-2026-62878. However, 0patch takes a different approach from traditional Windows Update downloads.
Acros' micropatches are "microscopic" updates delivered on the fly while the operating system is running. These updates typically modify just a few CPU instructions, applying fixes for critical vulnerabilities transparently without requiring a reboot or a conventional software update installation.
According to 0patch's alert, the new fixes target the following unsupported Windows Server releases: Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2. These aging server platforms are based on the same core codebases as Windows 7, Windows 8, and Windows 8.1, respectively.
The micropatching team said that "if you're using Windows that aren't receiving official security updates anymore, 0patch will make sure these vulnerabilities won't be exploited on your computers – and you won't even have to know or care about these things."
In recent years, 0patch expanded its support to Windows 10, offering paying customers and organizations five additional years of critical security fixes. Acros has now revealed that several more unsupported Windows releases will soon be added to the 0patch program, starting with Windows 10 version 22H2 enrolled in the first year of Extended Security Updates (ESU), in October 2026.