Best you can do for now is upgrade to CallPilot 5.1 and apply any service updates or patches to get yourself up to the most current release. What's that? Can't get those files? Gotta call your Nortel/Avaya vendor and have them do that for you.
MS will likely still support 2003 if it's an embedded version past the date they stop supporting OEM/retail. I suspect in the upcoming months, this will be addressed by Avaya.
In the meantime, you will want your CallPilot system to reside as far far away as possible from the internet too, as Nortel/Avaya does not like when people just start throwing MS patches on CallPilot systems (the 'approved' MS security updates are part of the normal SU/patch updates). Generally speaking - so long as traffic to/from the CallPilot system cannot be routed to/from the internet, they're updated exactly to Nortel/Avaya specs by a vendor, and you're not adding any 3rd party applications to it, the WinNT and Win2003 OS's running CallPilot are extremely stable and should not pose any risk to your enterprise.