Windows Server 2012/2012 R2 support ends

IPA Japan warns that Windows Server 2012 and 2012 R2 reached end of support on Oct 10, 2023, leaving unpatched systems exposed to future vulnerabilities.

IPA (Japan's Information-technology Promotion Agency) issued an advisory noting that Microsoft ended support for Windows Server 2012 and 2012 R2 on October 10, 2023. Without further security updates, any new vulnerabilities discovered in these OS versions will go unpatched, increasing the risk of information disclosure or service disruption for organizations that continue to run them. The advisory cites that roughly 80% of vulnerabilities found in these OS versions between July 2022 and June 2023 were rated high severity, and highlights several historically significant flaws — Follina (CVE-2022-30190), ProxyNotShell (CVE-2022-41040/CVE-2022-41082), and CVE-2023-23397 — that were previously exploited in APT attacks, as examples of the class of risk that will no longer receive vendor fixes on these platforms.

IPA recommends that organizations still running the affected OS migrate promptly to supported successor or alternative operating systems, and also review and validate third-party software (browsers, editors, etc.) running on top of these systems, since their support may lapse in parallel with the underlying OS. This is a policy/awareness advisory rather than a report of active exploitation tied to this specific end-of-life event.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2023/win2k12_eos.html