While Windows Server 2003 was a very good Operating System for quite some time, it will reach its End of Extended Support life on July 14th, 2015.
While mainstream support gives you free security updates, service packs, non-security related hotfixes and a wealth of other stuff, the extended support phase reduces this to security update support and no new features/service-packs.
The end of extended support then basically marks the end of the product lifecycle, where there are no new security updates published by Microsoft for free. Depending on the product, there is the possibility to extend this time period by some time, but it's very expensive.
(Refer to the Product Lifecycle FAQ @ Microsoft)
What does that mean for you?
If a security issue is found in Windows Server 2003 after July 14th, 2015, Microsoft will not issue a patch to fix the issue. Your server will be vulnerable - forever - from that point on forward.
We have seen and learned with Windows XP that even after months of awareness campaigns, that there are still a lot of Windows XP installations out there, even after months of its end of extended support. These systems are and remain vulnerable to current and future threats. Refer to Qualys Blog
It is therefore strongly recommended and definitely best practice to upgrade those systems before July 14th, 2015. Start now.