Microsoft ended support for Windows Server 2012 and 2012 R2 on October 10, 2023, leaving…

Microsoft ended support for Windows Server 2012 and 2012 R2 on October 10, 2023, leaving systems vulnerable to unpatched exploits.

Japan's Information-technology Promotion Agency (IPA) issued an advisory regarding the end-of-life (EOL) for Windows Server 2012 and Windows Server 2012 R2, which reached end-of-support on October 10, 2023 (US time). Following this milestone, Microsoft will no longer provide security updates for these operating systems, significantly increasing security risks for organizations continuing to use them.

The advisory highlights that during the 12-month period from July 2022 to June 2023, approximately 80% of vulnerabilities discovered in these OS versions were classified as high severity, with 4.4% rated as critical. Notably, several high-impact vulnerabilities discovered during this period — including CVE-2022-30190 (Follina), CVE-2022-41040 and CVE-2022-41082 (ProxyNotShell), and CVE-2023-23397 — were actively exploited in APT campaigns. The continued use of unsupported operating systems leaves organizations unable to remediate newly discovered vulnerabilities, exposing them to data breaches and service disruptions.

IPA recommends immediate migration to supported operating systems. The advisory also notes that third-party software running on these EOL platforms may similarly lose vendor support, compounding security risks. Organizations are urged to inventory and migrate both the operating systems and dependent applications to supported versions.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2023/win2k12_eos.html