Domain-joined Windows clients (Vista, 7, 8, 8.1 and RT) and servers (2003 to 2012) had a root-level, remotely exploitable vulnerability discovered in January 2014 but is now patched.
ANZ Bank has disabled the use of all online bank statements until a critical flaw is fixed.