Unsupported Windows OS

Plugin 108797 is a generic remote fingerprint for Microsoft Windows systems or service packs that are past vendor support. Tenable says it fires when the remote Windows release is missing a required service pack or is no longer supported. In practice that can include old families like Windows 7 (support ended 2020-01-14), Windows 8.1 (2023-01-10), Windows Server 2008 R2 SP1 (2020-01-14), Windows Server 2012 R2 (2023-10-10, with ESU caveats), and retired Windows 10 branches.

Tenable's Critical / 10.0 label is too blunt for real-world prioritization. An unsupported OS absolutely multiplies risk because it stops receiving normal fixes, but this finding is not itself an unauthenticated remote code execution path; the attacker still needs a reachable service and a real exploit for a specific unpatched Windows flaw. That makes this a HIGH estate-risk posture issue, not a clean CRITICAL exploit path on its own.

Why this verdict

• Blanket vendor scoring got walked down: Tenable assigns a generic 10.0 unsupported-software score, not a host-specific exploit path.
• Requires a second real weakness: attacker needs reachable SMB/RDP/RPC/other surface plus a valid unpatched flaw or credential path before impact happens.
• Exposure population matters: internal-only legacy servers are already behind a prior-compromise or east-west movement requirement, which is a strong downward pressure from CRITICAL.
• Blast radius keeps it elevated: once one unsupported Windows server is popped, old protocols, stale hardening, and admin sprawl can turn it into a lateral-movement hub.

Why not higher?

There is no single unauthenticated exploit here, no proof that a reachable service is vulnerable, and no KEV record for the finding itself. A CRITICAL label would only be fair once you pair this with actual external exposure plus a specific exploitable Windows flaw on the host.

Why not lower?

Unsupported Windows is not harmless backlog noise. It permanently drops the host out of normal security maintenance, and the historical Windows track record of exploited SMB/RDP/identity bugs means these boxes age into easier footholds over time.

1. Segment legacy Windows now — Place unsupported Windows hosts behind strict east-west ACLs and management jump paths, and remove broad user/workstation reachability. For a HIGH verdict, deploy this within 30 days to cut the easiest exploitation and pivot routes while the upgrade plan is executed.
2. Kill unnecessary SMB and RDP exposure — Disable or firewall SMBv1, unnecessary SMB listening, RDP from user networks, and WinRM where not explicitly required. Do this within 30 days because most practical attack chains against old Windows begin with an overly reachable management or file-sharing surface.
3. Harden the host with EDR and credential protections — Enforce EDR, tamper protection, ASR rules, LSASS protections, and local admin reduction so a single foothold does not immediately become credential theft. Roll this out within 30 days on every host that cannot yet be upgraded.
4. Validate ESU and support exceptions — For Windows Server 2012/2012 R2 or cloud-hosted edge cases, confirm whether the host is actually covered by ESU or another vendor-backed support arrangement. Complete this validation within 30 days so you do not waste migration effort on false unsupported classifications.

Run this on the target Windows host from an elevated or standard PowerShell session; local admin is helpful for complete hotfix visibility but usually not required. Save as check-unsupported-windows.ps1 and run powershell -ExecutionPolicy Bypass -File .\check-unsupported-windows.ps1; it prints exactly VULNERABLE, PATCHED, or UNKNOWN and exits 1, 0, or 2 respectively.

# check-unsupported-windows.ps1

# Outputs exactly one of: VULNERABLE / PATCHED / UNKNOWN

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'Stop'

function Finish([string]$status, [int]$code) {
    Write-Output $status
    exit $code
}

try {
    $cv = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
    $product = [string]$cv.ProductName
    $displayVersion = [string]$cv.DisplayVersion
    $releaseId = [string]$cv.ReleaseId
    $edition = [string]$cv.EditionID
    $build = [int]$cv.CurrentBuildNumber

    # Helper: latest hotfix date if available

    $latestHotfix = $null
    try {
        $hf = Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1
        if ($hf -and $hf.InstalledOn) { $latestHotfix = [datetime]$hf.InstalledOn }
    } catch {}

    # Definitely unsupported client/server families

    $definitelyUnsupported = @(
        'Windows XP', 'Windows Vista', 'Windows 7', 'Windows 8', 'Windows 8.1',
        'Windows Server 2003', 'Windows Server 2008', 'Windows Server 2008 R2'
    )

    foreach ($name in $definitelyUnsupported) {
        if ($product -like "*$name*") {
            Finish 'VULNERABLE' 1
        }
    }

    # Windows Server 2012 / 2012 R2: lifecycle ended 2023-10-10, but ESU can apply.

    if ($product -match 'Windows Server 2012 R2|Windows Server 2012') {
        if ($latestHotfix -and $latestHotfix -ge (Get-Date).AddDays(-120)) {
            Finish 'UNKNOWN' 2
        } else {
            Finish 'VULNERABLE' 1
        }
    }

    # Windows 10 support is edition/release dependent. Treat LTSC/LTSB as UNKNOWN.

    if ($product -match 'Windows 10') {
        if ($product -match 'LTSC|LTSB|IoT') {
            Finish 'UNKNOWN' 2
        }

        $win10FinalSupport = Get-Date '2025-10-14'
        $ver = if ($displayVersion) { $displayVersion } else { $releaseId }

        if ($ver -eq '22H2') {
            if ((Get-Date) -le $win10FinalSupport) {
                Finish 'PATCHED' 0
            } else {
                Finish 'VULNERABLE' 1
            }
        } elseif ($ver) {
            Finish 'VULNERABLE' 1
        } else {
            Finish 'UNKNOWN' 2
        }
    }

    # Windows 11 generally supported, but unusual editions may need manual review.

    if ($product -match 'Windows 11') {
        Finish 'PATCHED' 0
    }

    # Supported server families commonly seen in enterprise.

    if ($product -match 'Windows Server 2016|Windows Server 2019|Windows Server 2022|Windows Server 2025') {
        Finish 'PATCHED' 0
    }

    Finish 'UNKNOWN' 2
}
catch {
    Finish 'UNKNOWN' 2
}

Sources

1. Tenable Plugin 108797
2. Tenable SEoL plugin conversion note
3. Microsoft Lifecycle - Windows 8.1
4. Microsoft Lifecycle - Windows Server 2008 R2
5. Microsoft Lifecycle - Windows Server 2012 R2
6. Microsoft Lifecycle - Windows 10 Home and Pro
7. CISA Known Exploited Vulnerabilities Catalog
8. NVD - CVE-2019-0708 BlueKeep