IE CVE-2010-3962: 2010 Zero-Day Added to KEV in 2025
This bug only affects IE 6, 7 and 8, which no supported Windows version runs, and it was patched in December 2010; the only real exposure is a forgotten legacy machine, which should be isolated and replaced.
Must act: Anyone still running Windows XP, Server 2003, Vista, Server 2008 or an original Windows 7 build with IE 6, 7 or 8 and without MS10-090, such as old kiosks, lab PCs or industrial control workstations.
Can relax: Everyone on supported Windows versions using Microsoft Edge, Edge's IE mode or IE 9 and later; the affected list covers only IE 6, 7 and 8.
- Search your asset inventory for Windows XP, Server 2003, Vista and Server 2008 machines, and for Windows 7 systems still on IE 8.
- Replace or upgrade those systems; if one must stay, confirm MS10-090 or a later IE cumulative update is installed.
- Block legacy machines from browsing the internet and from opening email, and isolate them on their own network segment.