Windows Server 2012 Support Ends

Microsoft ended support for Windows Server 2012 and 2012 R2 on October 10, 2023, leaving unpatched systems exposed to future vulnerabilities.

IPA Japan issued an advisory noting that Windows Server 2012 and 2012 R2 reached end of support on October 10, 2023. After this date, Microsoft will no longer issue security updates for these operating systems, meaning any newly discovered vulnerabilities will go unpatched, increasing the risk of information leakage, service disruption, and other security incidents for organizations still running these platforms.

The advisory cites historical data showing that roughly 80% of vulnerabilities found in these OS versions between July 2022 and June 2023 were rated high severity, with 4.4% rated critical. It further notes that several high-severity flaws affecting these platforms — CVE-2022-30190 (Follina), CVE-2022-41040/CVE-2022-41082 (ProxyNotShell), and CVE-2023-23397 — have previously been exploited in APT attacks, underscoring the real-world exploitation risk of unpatched legacy Windows Server systems.

IPA recommends that organizations still using Windows Server 2012 or 2012 R2 migrate promptly to a supported OS version. It also warns that third-party software (browsers, editors, etc.) running on these systems may lose vendor support as a consequence, compounding the security exposure, and advises verifying and updating dependent software ahead of migration.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2023/win2k12_eos.html