© Russell Cheyne / Reuters
It is the same software controversially used on the UK's nuclear armed Vanguard submarines. Windows XP has not been supported by Microsoft since 2014.
In May, a massive cyberattack struck the National Health Service (NHS), which also uses the software.
During a press visit to the 65,000-tonne carrier ahead of her test launch on Monday, journalists from the Times noticed the software was in use.
"If XP is for operational use, it is extremely risky," Professor Alan Woodward, an IT expert at the University of Surrey, told the Times.
"Why would you put an obsolete system in a new vessel that has a lifetime of decades?"
One defense source, who told the paper the system would be refitted when the second carrier, HMS Prince of Wales, was launched in 2026, said: "Just think about the difference between year 2000 desktops compared with modern units."
The Navy defended the presence of the ageing system, which has not received Microsoft security updates for many years.
Commander Mark Deller, who serves aboard the Queen Elizabeth in the control center where the system was spotted, said: "The ship is well designed and there has been a very, very stringent procurement train that has ensured we are less susceptible to cyber [attacks] than most."
The news comes as it was announced the Ministry of Defense (MoD) has been told to plan up to £20 billion ($25.5 billion) in savings over the next decade or risk losing out on major projects.
Stephen Lovegrove, the MoD permanent secretary, warned that the procurement and development of jets, submarines and tanks could also be at risk, according to the Times.
The later OSs make me nuts, much ado about not a lot in my view and a ton of useless overhead. 64-bit would be nice though to run some more modern apps but then there's XP x64.
Then of course there's 'Outlook Express' native to both 32- and 64-bit XP as well as the now ancient Mac OS 9.x.x. Perhaps the best e-mail client of all time. I have two years worth of 'Add-ons' and hacking and thrashing about to beat T'bird into something like a decent a client. Even at that though I had to do dumb stuff server-side to make it properly handle a gamut of e-mail addresses.
Out of the box it's a complete dog's dinner . . . I cannot imagine how the inexperienced make it run satisfactorily.