VulnSocial

CVE-2003-0352General(microsoft / windows_2000)

MEDIUMCVSS 7.5 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Prioritize remediation for microsoft windows_2000 systems immediately
  • Assume compromise if assets are exposed
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

Buffer overflow in a certain DCOM interface for RPC in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary code via a malformed message, as exploited by the Blaster/MSblast/LovSAN and Nachi/Welchia worms.

microsoft CVEsBack to dashboard
4.0/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Other references

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • windows_2000
  • windows_2003_server
  • windows_nt
  • windows_xp

Threat summary

  • Active exploitation appears in 1 classified signals
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Technical details provided in 1 signal
  • General: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-05-15); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
microsoft
Products
windows_2000windows_2003_serverwindows_ntwindows_xp

6 versions affected across 4 products

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-05-15: 1Mentions · 2026-06-21: 1Active Exploitation · 2026-06-21: 1Technical Details · 2026-06-21: 105-1506-21
Signal classification2 categories
General
150.0%
Active Exploitation
150.0%
Classification over time
DateTotalLabels
2026-05-151
General1
2026-06-211
Active Exploitation1
Full discourse2 posts
  • MarcoFigueroa@MarcoFigueroa
    Active Exploitation

    🚨I’m old AF🚨 I just realized MSBlast CVE-2003-0352 was the first worm I worked on! It hit my employer and the soda factories in Brazil was shut down! My boss jumped on a plane to triage it on the ground, which gave me a 12-hour countdown until he landed. 🛬 My job before wheels-down: figure out how to stop the bleeding. It spread over TCP port 135, no user interaction needed just being an unpatched machine on the network was enough!!!

    Post summary

    A personal recollection of the MSBlast worm (CVE‑2003‑0352) detailing its active in‑the‑wild spread over TCP port 135, affecting workplaces and Brazilian soda factories.

    11090823
    12.4K followersView on X
  • truemorgan@_truemorgan
    General

    Windows: CVE-2017-0144 CVE-2017-0145 CVE-2008-4250 CVE-2019-0708 CVE-2020-1472 CVE-2021-34527 CVE-2021-26855 CVE-2020-1350 CVE-2003-0352 CVE-2014-6324 CVE-2017-0199 CVE-2021-40444 CVE-2022-30190 CVE-2021-31166 CVE-2022-21907 CVE-2019-1182 CVE-2019-1181 CVE-2020-0601 CVE-2023-29363 CVE-2023-32014 CVE-2025-24985 CVE-2025-24993 CVE-2024-38063 CVE-2022-34718 CVE-2021-26857 CVE-2021-36934 CVE-2022-37969 CVE-2022-41033 CVE-2022-38028 CVE-2023-28252 CVE-2024-26169 CVE-2025-29824 CVE-2025-30400 CVE-2025-32701 CVE-2025-32706 CVE-2016-0099 CVE-2020-1048 CVE-2017-8529 CVE-2020-0688 CVE-2021-42287 CVE-2021-42278 CVE-2022-26923 CVE-2021-34523 CVE-2021-31207 CVE-2026-32202 CVE-2017-5754 CVE-2017-5753 CVE-2018-3639 CVE-2019-11135 CVE-2018-3620

    Post summary

    The text simply enumerates a list of Windows-related CVE identifiers without providing any additional context or details.

    10000106
    15 followersView on X
CPE platform detail48 entries

48 of 48 entries

PartVendorProductVersionTarget SWTarget HW
OSmicrosoftwindows_2000---
OSmicrosoftwindows_2000---
OSmicrosoftwindows_2000---
OSmicrosoftwindows_2000---
OSmicrosoftwindows_2000---
OSmicrosoftwindows_2003_serverenterprise--
OSmicrosoftwindows_2003_serverenterprise_64-bit--
OSmicrosoftwindows_2003_serverr2--
OSmicrosoftwindows_2003_serverr2--
OSmicrosoftwindows_2003_serverstandard--
OSmicrosoftwindows_2003_serverweb--
OSmicrosoftwindows_nt4.0--
OSmicrosoftwindows_nt4.0--
OSmicrosoftwindows_nt4.0--
OSmicrosoftwindows_nt4.0--
OSmicrosoftwindows_nt4.0--
OSmicrosoftwindows_nt4.0--
OSmicrosoftwindows_nt4.0--
OSmicrosoftwindows_nt4.0--
OSmicrosoftwindows_nt4.0--
OSmicrosoftwindows_nt4.0--
OSmicrosoftwindows_nt4.0--
OSmicrosoftwindows_nt4.0--
OSmicrosoftwindows_nt4.0--
OSmicrosoftwindows_nt4.0--
OSmicrosoftwindows_nt4.0--
OSmicrosoftwindows_nt4.0--
OSmicrosoftwindows_nt4.0--
OSmicrosoftwindows_nt4.0--
OSmicrosoftwindows_nt4.0--
OSmicrosoftwindows_nt4.0--
OSmicrosoftwindows_nt4.0--
OSmicrosoftwindows_nt4.0--
OSmicrosoftwindows_nt4.0--
OSmicrosoftwindows_nt4.0--
OSmicrosoftwindows_nt4.0--
OSmicrosoftwindows_nt4.0--
OSmicrosoftwindows_nt4.0--
OSmicrosoftwindows_nt4.0--
OSmicrosoftwindows_nt4.0--
OSmicrosoftwindows_nt4.0--
OSmicrosoftwindows_nt4.0--
OSmicrosoftwindows_nt4.0--
OSmicrosoftwindows_xp---
OSmicrosoftwindows_xp---
OSmicrosoftwindows_xp---
OSmicrosoftwindows_xp---
OSmicrosoftwindows_xp---

Explore more

Back to dashboardmicrosoft CVEswindows_2000 vulnerabilities