What was reported
Maeil Business Newspaper (MK) reported on November 5, 2026 that it obtained the ministry's "2027 Budget Project Description Data" from the office of National Assembly member Kim Dae-sik. According to those documents, the ministry reported to the legislature that the "integrated business management system for diplomatic missions abroad" is exposed to serious security threats because of its age.
The system was built in 2011. It distributes sensitive documents on diplomacy, military affairs, intelligence and security. Users include officials at overseas missions from agencies such as the National Intelligence Service, the Defense Ministry, the Foreign Ministry and the Trade Ministry, plus headquarters staff in Korea.
The report says the system still relies on:
- Windows Server 2008 R2.
- Internet Explorer-based components.
- ActiveX and browser plug-ins.
- Discontinued or aging server hardware.
Most of this comes from ministry budget material relayed by a newspaper. The figures have not been independently audited. The report gives no host-by-host inventory, no network diagram and no CVE. It doesn't say whether any attacker has touched the system.
Why Windows Server 2008 R2 is the sore point
Windows Server 2008 R2's lifecycle is well documented. Microsoft's lifecycle page marks it as out of support and lists extended support as ending in January 2020. The MK report puts that end of support six years ago.
Microsoft did offer a paid lifeline. Extended Security Updates (ESU) covered eligible volume-licensed editions for up to three more years. Customers could get a fourth year of free ESUs only on Azure. Microsoft's own Tech Community post gave January 9, 2024 as the last date for that Azure-only year. Other sources, including Microsoft's lifecycle page, put the end of the non-Azure ESU program in January 2023.
There was one more tail. Grandfathered Premium Assurance security update support for the 2008 R2 line ended on January 13, 2026, according to Wikipedia. Legacy Update, a site that tracks legacy Windows servicing, also marked January 13, 2026 as the date Windows Server 2008 and 2008 R2 finally reached end of support.
That timeline matters for how the Korean story is read. The report doesn't say whether any of these servers were covered by ESU or Premium Assurance. So it would be wrong to assume every machine has gone without all patches since 2020. Even so, every one of those programs has now ended. If the servers are still on 2008 R2, any vulnerability found today won't be patched by Microsoft. As one vendor summary put it, vulnerabilities discovered after this date will no longer be patched by Microsoft.
The numbers, kept separate
The report mixes several different counts, so they are listed here without merging them.
| Item | Reported figure |
|---|---|
| Aging servers in the diplomatic-missions system | 114 |
| Ministry's comparison for those servers | About 58% of overseas missions (the measure is not explained) |
| Threat-management systems (introduced 2019) aging | 188 of 197 overseas missions |
| Business-network security gear, longest service | Up to 10 years, against a 6-year useful life |
| Phishing-training system age | More than 10 years |
| Servers chosen for replacement in 2027 | 31 of 114 |
Three cautions apply.
- The 58% figure is the ministry's own comparison. It isn't a calculated share of servers.
- The 114 servers are not stated to all run Windows Server 2008 R2.
- The 188-of-197 figure belongs to a different security system than the 114 servers.
Security gear and training are aging too
The ministry also points to the defensive layer around the servers:
- At headquarters, intrusion detection systems, web firewalls and malicious-traffic detection are described as too old to counter increasingly sophisticated attacks.
- The employee phishing-response training system is said to fail often and to be impossible to update. It reportedly can't handle current phishing styles, and its employee records don't match reality. The ministry reportedly called the training nominal and said urgent replacement was needed.
- Replacement of business-network security equipment at missions was planned for 2023 to 2025. Budget cuts delayed it.
None of this shows that staff failed a phishing test or that an intrusion happened. It does show that old servers and old defenses are stacked together. A legacy OS is easier to live with when modern detection sits in front of it. That safety net is itself reported to be worn.
The 2027 budget proposal
The ministry's 2027 proposal newly includes 1.773 billion won for replacing old servers on the classified-document network. It also includes 5.628 billion won for replacing aging information-protection systems. These are proposed amounts, not enacted appropriations.
A ministry official said the plan is to replace all servers whose technical support has ended next year. Remaining old servers would follow in stages by urgency. The official also said all aging information-protection systems would be replaced.
The catch is the 31 figure. Only 31 of the 114 aging servers were selected for replacement in 2027. The rest will wait, which means the full cleanup is likely to take longer.
Analysis: what IT admins can take from this
This is general industry reasoning, not a finding from the report. Government and enterprise systems tend to get stuck on old Windows Server versions when they depend on browser-era technology like ActiveX and Internet Explorer. The server can't move until the application does. A server upgrade then becomes an application rewrite, and that is why a hardware budget alone can stall for years.
A counterargument is that isolated or air-gapped networks, strict segmentation and compensating controls can reduce the risk of an unsupported OS. The report doesn't say what such controls exist here. It is still fair to note that the ministry itself called the exposure serious, and that it also described its perimeter defenses as aging.
For admins with similar legacy estates, the practical checklist is familiar:
- Inventory every system on unsupported Windows Server versions, including hardware age.
- Map which applications are tied to Internet Explorer, ActiveX or plug-ins, since those block OS upgrades.
- Confirm whether any ESU or other extended coverage actually applies. Check expiry dates, since all 2008 R2 coverage has ended.
- Isolate unsupported hosts with segmentation and tight access controls while migration is pending.
- Prioritize by support status first, then by urgency, which is the approach the ministry says it will take.
- Fund the monitoring and training layers alongside server replacement.
Bottom line
The reporting establishes a budget-driven maintenance backlog in a sensitive government system. It has an unsupported operating system, a partial replacement plan and aging defenses. It doesn't establish a breach, an exploited flaw or a final budget. The 2027 appropriation and the pace of the 31-of-114 server swap are the next things to watch.