The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical remote code execution (RCE) vulnerability in the Microsoft Windows Video ActiveX Control to its Known Exploited Vulnerabilities (KEV) catalog.
Tracked as CVE-2008-0015, this flaw, originally disclosed nearly two decades ago, now confirms active exploitation in the wild.
CISA updated the catalog on February 17, 2026, urging immediate patching due to real-world attacks targeting unpatched systems.
This development underscores the persistent dangers of legacy software in modern environments. Attackers exploit the vulnerability by luring users to malicious webpages loaded with specially crafted inputs.
Once triggered, the ActiveX control mishandles data, enabling arbitrary code execution with the privileges of the logged-in user.
Administrative access could let attackers install malware, steal data, create backdoor accounts, or pivot deeper into networks.
Federal Civilian Executive Branch (FCEB) agencies must remediate by March 10, 2026, per Binding Operational Directive (BOD) 22-01.
CISA advises all organizations to follow suit, applying Microsoft’s patches or disabling the control where possible.
No specific ransomware links have surfaced yet, but the RCE nature demands urgency from defenders monitoring endpoints and web traffic.
| CVE ID | Vulnerability Name | Date Added | Due Date |
|---|---|---|---|
| CVE-2008-0015 | Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability | 2026-02-17 | 2026-03-10 |
The flaw stems from improper input validation in the Windows Video ActiveX Control, a component for embedding video playback in Internet Explorer and legacy apps.
Threat actors craft HTML pages that invoke the control with malformed parameters, bypassing protections and running shellcode directly in the browser context.
Exploitation requires no authentication, making it ideal for drive-by downloads via phishing or malvertising.
Successful attacks grant attackers the victim’s user rights, escalating to full system compromise if elevated privileges exist.
This could facilitate lateral movement, data exfiltration, or persistence via new accounts. Legacy Windows versions like XP, Vista, and early 7 builds are most exposed, but unpatched modern systems with ActiveX enabled remain vulnerable, especially in enterprise environments retaining old IE modes.
CISA’s KEV addition signals FCEB prioritization, butthe private sectors face equal threats. Network defenders should scan for the control via tools like Microsoft Baseline Security Analyzer, enforce patch baselines, and block ActiveX in group policies.
Disable unnecessary browser plugins and monitor for anomalous web traffic to IPs hosting exploits.
Microsoft provides fixes in security updates post-2008; verify deployment with WSUS or Intune.
This case highlights legacy code’s shadow risks amid evolving threats. Organizations delaying patches invite breaches, as attackers recycle old flaws for low-detection gains.
endpoint detection rules for CVE-2008-0015 indicators, including suspicious ActiveX instantiations.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google
%20(1).webp?fit=1600,900&ssl=1&description=Tracked as CVE-2008-0015, this flaw, originally disclosed nearly two decades ago, now confirms active exploitation in the wild.){kind=link}