VulnerabilityAnalyzed

CVE-2019-0708

Microsoft Remote Desktop Services Remote Code Execution Vulnerability

KEVEXPLOIT ×4 ✓CRITICAL 9.8EPSS 100.0%

Does this matter?

Known to be exploited in the wild (CISA KEV, CISA remediation deadline 3 May 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.

Description

A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 100.00% probability · 100th percentile
Public exploits: 4 in Exploit-DB · verified · first 30 May 2019
CISA KEV: Listed 3 November 2021 · due 3 May 2022 · used in ransomware campaigns
Weakness: CWE-416
Affected: microsoft/windows 7 · microsoft/windows server 2008 · siemens/axiom multix m firmware · siemens/axiom vertix md trauma firmware · siemens/axiom vertix solitaire m firmware · siemens/mobilett xp digital firmware · siemens/multix pro acss p firmware · siemens/multix pro p firmware · siemens/multix pro firmware · siemens/multix pro acss firmware · siemens/multix pro navy firmware · siemens/multix swing firmware · siemens/multix top firmware · siemens/multix top acss firmware · siemens/multix top p firmware · siemens/multix top acss p firmware · siemens/vertix solitaire firmware · siemens/atellica solution firmware · siemens/aptio firmware · siemens/streamlab firmware · +40 more
Source: secure@microsoft.com

EPSS trend

EPSS 100.0% since 27 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

CISA notes

Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2019-0708

Public exploits (4)

Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.

EDB-ID	Title	Type	Published	Verified
EDB-47683 source ↗	Microsoft Windows 7 (x86) - 'BlueKeep' Remote Desktop Protocol (RDP) Remote Windows Kernel Use After Freewindows_x86 · 0xeb-bp	remote	19 November 2019	no
EDB-47416 source ↗	Microsoft Windows - BlueKeep RDP Remote Windows Kernel Use After Free (Metasploit)windows · Metasploit	remote	24 September 2019	yes
EDB-47120 source ↗	Microsoft Windows Remote Desktop - 'BlueKeep' Denial of Service (Metasploit)windows · RAMELLA Sebastien	dos	15 July 2019	no
EDB-46946 source ↗	Microsoft Windows Remote Desktop - 'BlueKeep' Denial of Servicewindows · n1xbyte	dos	30 May 2019	no

References

http://packetstormsecurity.com/files/153133/Microsoft-Windows-Remote-Desktop-BlueKeep-Denial-Of-Service.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/153627/Microsoft-Windows-RDP-BlueKeep-Denial-Of-Service.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/154579/BlueKeep-RDP-Remote-Windows-Kernel-Use-After-Free.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/155389/Microsoft-Windows-7-x86-BlueKeep-RDP-Use-After-Free.htmlThird Party Advisory, VDB Entry
http://packetstormsecurity.com/files/162960/Microsoft-RDP-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190529-01-windows-enThird Party Advisory
http://www.huawei.com/en/psirt/security-notices/huawei-sn-20190515-01-windows-enThird Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-166360.pdfThird Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-406175.pdfThird Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-433987.pdfThird Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-616199.pdfThird Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-832947.pdfThird Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-932041.pdfThird Party Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708Patch, Vendor Advisory
http://packetstormsecurity.com/files/153133/Microsoft-Windows-Remote-Desktop-BlueKeep-Denial-Of-Service.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/153627/Microsoft-Windows-RDP-BlueKeep-Denial-Of-Service.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/154579/BlueKeep-RDP-Remote-Windows-Kernel-Use-After-Free.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/155389/Microsoft-Windows-7-x86-BlueKeep-RDP-Use-After-Free.htmlThird Party Advisory, VDB Entry
http://packetstormsecurity.com/files/162960/Microsoft-RDP-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190529-01-windows-enThird Party Advisory
http://www.huawei.com/en/psirt/security-notices/huawei-sn-20190515-01-windows-enThird Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-166360.pdfThird Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-406175.pdfThird Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-433987.pdfThird Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-616199.pdfThird Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-832947.pdfThird Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-932041.pdfThird Party Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708Patch, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0708US Government Resource

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.