Loading story…
Attackers widely exploited CVE-2003-0352, a critical buffer overflow in the Windows RPC DCOM interface that allows remote code execution through malformed messages. The flaw affects Windows NT 4.0, 2000, XP, and Server 2003. SANS Internet Storm Center reported that more than one-quarter of its sensors had detected scanning for the vulnerability in August 2003, with multiple easy-to-use exploits attacking systems. An in-the-wild Trojan/IRC bot identified as Backdoor.IRC.Cirebot also exploited the flaw to recruit compromised machines; Check Point subsequently documented exploitation by worms including Blaster/MSblast/LovSAN and Nachi/Welchia.
Microsoft released a patch on July 16, 2003, under bulletin MS03-026. SANS urged prompt patching, supplementary firewall restrictions, and disabling DCOM where feasible, and supplied four Snort detection rules. Check Point classified the vulnerability as critical and documented a Blaster Attacks IPS protection that blocks DCE-RPC requests matching specified operation numbers and byte patterns, with activation guidance and attack-blocking logs for several Security Gateway versions. Organizations retaining affected legacy systems should prioritize remediation or isolation and use network detection and blocking as supplementary controls, not substitutes for patching.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
On July 16, 2003, Microsoft made a patch available for CAN-2003-0352, now CVE-2003-0352, addressed by security bulletin MS03-026. The vulnerability allows remote code execution through malformed RPC messages.
On September 7, 2007, Check Point published an advisory classifying CVE-2003-0352 as critical and describing its Blaster Attacks IPS protection. The advisory detailed DCE-RPC request-matching conditions used to block attacks and provided protection activation instructions.
Check Point identified Blaster, also listed as MSblast and LovSAN, and Nachi, also known as Welchia, as worms that exploited the RPC DCOM vulnerability.
An update to the SANS advisory reported an in-the-wild Trojan/IRC bot exploiting the vulnerability to recruit systems. The update linked to Symantec's Backdoor.IRC.Cirebot entry as its reference.
The Internet Storm Center reported that more than one-quarter of its participating sensors had detected scanning for the vulnerability. Its advisory also supplied four Snort rules for detecting suspicious DCERPC bind attempts on TCP ports 135 and 445.
Attackers refined and released multiple exploits during the two weeks preceding the SANS advisory. The advisory described the exploits as easy to use and already deployed against numerous systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed critical vulnerabilities in the Windows `RPCSS` service used for DCOM activation, including buffer overruns that let remote attackers send malformed RPC messages and execute arbitrary code with **Local System** privileges. The flaws affected Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003, and Microsoft said the updated fix in **MS03-039** superseded earlier patches from **MS03-026** and **MS01-048** while also addressing a denial-of-service issue in the same component. Security researchers and network defenders reported that the DCOM-related RPC weakness, primarily exposed over **TCP/UDP 135**, was already being scanned and exploited in the wild, with underground exploit code in circulation and additional concern around **TCP 593** and COM Internet Services exposure. Microsoft and ISS urged organizations to deploy the patch immediately and reduce exposure by filtering affected RPC/DCOM ports, disabling COM Internet Services and RPC over HTTP where possible, using host firewalls or IPsec filters, and disabling DCOM on systems that did not require it.
Jun 29, 2026
Microsoft disclosed **CVE-2026-62781**, a high-severity remote code execution flaw in the Windows **RPC Runtime Library** that allows an unauthenticated attacker to execute code over the network. The heap-based buffer overflow, tracked as **CWE-122** and scored **CVSS 8.1**, affects a broad range of Windows client and server platforms, including Windows 10, Windows 11, and Windows Server 2012, 2016, 2019, 2022, and 2025, according to the CVE entry and Microsoft advisory. The exposure is notable because exploitation of remote services has repeatedly enabled rapid lateral movement and internal propagation across Windows environments. MITRE ATT&CK maps this activity to **`T1210`**, citing past abuse of SMB, Netlogon, RPC, and Print Spooler flaws by threats such as WannaCry, NotPetya, TrickBot, Conficker, and multiple intrusion groups; Splunk has also tied remote-service exploitation detections to the same technique in prior RCE-related content. Security teams are likely to treat the new RPC flaw as a priority patching issue given its network-reachable nature and the history of Windows remote-service vulnerabilities being used for enterprise-wide spread.
Aug 12, 2026
Microsoft released fixes for **critical remote code execution vulnerabilities** in the Windows RPC Runtime, including **`CVE-2022-26809`**, a flaw in `rpcrt4.dll` that could allow **unauthenticated, zero-click code execution** on vulnerable systems. Security reporting said the bug stemmed from an integer overflow that could lead to a heap buffer overflow during RPC processing, affecting both client-side and server-side code paths in Windows. Researchers warned that unpatched systems exposing **TCP port `445`** were at particular risk, with internet scanning indicating that **more than 700,000** Windows machines could be reachable and potentially vulnerable. Microsoft’s April security updates addressed the issue, while defenders were urged to **apply patches**, **block external access to port `445`**, and **restrict inbound connections** to reduce exposure.
Aug 6, 2026