{"id":"CVE-2019-0708","url":"https://www.cyber-defence.io/tools/cve/CVE-2019-0708","generatedAt":"2026-10-28T22:41:38.453Z","title":"Microsoft Remote Desktop Services Remote Code Execution Vulnerability","description":"A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.","published":"2019-05-16T19:29:00.000Z","lastModified":"2026-06-17T02:08:44.000Z","status":"Analyzed","sourceIdentifier":"secure@microsoft.com","cvss":{"version":"3.1","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-416"],"affected":["microsoft/windows 7","microsoft/windows server 2008","siemens/axiom multix m firmware","siemens/axiom vertix md trauma firmware","siemens/axiom vertix solitaire m firmware","siemens/mobilett xp digital firmware","siemens/multix pro acss p firmware","siemens/multix pro p firmware","siemens/multix pro firmware","siemens/multix pro acss firmware","siemens/multix pro navy firmware","siemens/multix swing firmware","siemens/multix top firmware","siemens/multix top acss firmware","siemens/multix top p firmware","siemens/multix top acss p firmware","siemens/vertix solitaire firmware","siemens/atellica solution firmware","siemens/aptio firmware","siemens/streamlab firmware","siemens/centralink firmware","siemens/viva e firmware","siemens/viva twin firmware","siemens/syngo lab process manager","siemens/rapidpoint 500 firmware","siemens/lantis firmware","huawei/agile controller-campus firmware","huawei/bh620 v2 firmware","huawei/bh621 v2 firmware","huawei/bh622 v2 firmware","huawei/bh640 v2 firmware","huawei/ch121 firmware","huawei/ch140 firmware","huawei/ch220 firmware","huawei/ch221 firmware","huawei/ch222 firmware","huawei/ch240 firmware","huawei/ch242 firmware","huawei/ch242 v3 firmware","huawei/e6000 firmware","huawei/e6000 chassis firmware","huawei/gtsoftx3000 firmware","huawei/oceanstor 18500 firmware","huawei/oceanstor 18800 firmware","huawei/oceanstor 18800f firmware","huawei/oceanstor hvs85t firmware","huawei/oceanstor hvs88t firmware","huawei/rh1288 v2 firmware","huawei/rh1288a v2 firmware","huawei/rh2265 v2 firmware","huawei/rh2268 v2 firmware","huawei/rh2285 v2 firmware","huawei/rh2285h v2 firmware","huawei/rh2288 v2 firmware","huawei/rh2288a v2 firmware","huawei/rh2288e v2 firmware","huawei/rh2288h v2 firmware","huawei/rh2485 v2 firmware","huawei/rh5885 v2 firmware","huawei/rh5885 v3 firmware"],"epss":{"score":0.99999,"percentile":0.99999,"date":"2026-10-27","history":[]},"kev":{"listed":true,"dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","notes":"Apply updates per vendor instructions.\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-0708"},"exploits":{"count":4,"verified":true,"firstPublished":"2019-05-30","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":47683,"kind":"exploit","title":"Microsoft Windows 7 (x86) - 'BlueKeep' Remote Desktop Protocol (RDP) Remote Windows Kernel Use After Free","url":"https://www.exploit-db.com/exploits/47683","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/windows_x86/remote/47683.py","file":"exploits/windows_x86/remote/47683.py","published":"2019-11-19","added":"2019-11-19","updated":"2019-11-19","author":"0xeb-bp","type":"remote","platform":"windows_x86","port":null,"verified":false,"codes":["CVE-2019-0708"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://github.com/0xeb-bp/bluekeep/tree/334443948296e8624c76a5ae30a2562658afd176"},{"edbId":47416,"kind":"exploit","title":"Microsoft Windows - BlueKeep RDP Remote Windows Kernel Use After Free (Metasploit)","url":"https://www.exploit-db.com/exploits/47416","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/windows/remote/47416.rb","file":"exploits/windows/remote/47416.rb","published":"2019-09-24","added":"2019-09-24","updated":"2019-09-24","author":"Metasploit","type":"remote","platform":"windows","port":3389,"verified":true,"codes":["CVE-2019-0708"],"tags":"Use After Free (UAF)","aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/rdp/cve_2019_0708_bluekeep_rce.rb"},{"edbId":47120,"kind":"exploit","title":"Microsoft Windows Remote Desktop - 'BlueKeep' Denial of Service (Metasploit)","url":"https://www.exploit-db.com/exploits/47120","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/windows/dos/47120.rb","file":"exploits/windows/dos/47120.rb","published":"2019-07-15","added":"2019-07-15","updated":"2019-07-15","author":"RAMELLA Sebastien","type":"dos","platform":"windows","port":3389,"verified":false,"codes":["CVE-2019-0708"],"tags":"Denial of Service (DoS)","aliases":"Bluekeep","applicationUrl":null,"screenshotUrl":null,"referenceUrl":null},{"edbId":46946,"kind":"exploit","title":"Microsoft Windows Remote Desktop - 'BlueKeep' Denial of Service","url":"https://www.exploit-db.com/exploits/46946","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/windows/dos/46946.py","file":"exploits/windows/dos/46946.py","published":"2019-05-30","added":"2019-05-31","updated":"2019-06-03","author":"n1xbyte","type":"dos","platform":"windows","port":null,"verified":false,"codes":["CVE-2019-0708"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://github.com/n1xbyte/CVE-2019-0708/blob/b44a1ec077c56f0400cb2cb6faf40180b87459a6/crashpoc.py"}]},"verdict":{"level":"urgent","text":"Known to be exploited in the wild (CISA KEV, CISA remediation deadline 3 May 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise."},"changes":[],"references":[{"url":"http://packetstormsecurity.com/files/153133/Microsoft-Windows-Remote-Desktop-BlueKeep-Denial-Of-Service.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"secure@microsoft.com"},{"url":"http://packetstormsecurity.com/files/153627/Microsoft-Windows-RDP-BlueKeep-Denial-Of-Service.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"secure@microsoft.com"},{"url":"http://packetstormsecurity.com/files/154579/BlueKeep-RDP-Remote-Windows-Kernel-Use-After-Free.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"secure@microsoft.com"},{"url":"http://packetstormsecurity.com/files/155389/Microsoft-Windows-7-x86-BlueKeep-RDP-Use-After-Free.html","tags":["Third Party Advisory","VDB Entry"],"source":"secure@microsoft.com"},{"url":"http://packetstormsecurity.com/files/162960/Microsoft-RDP-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"secure@microsoft.com"},{"url":"http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190529-01-windows-en","tags":["Third Party Advisory"],"source":"secure@microsoft.com"},{"url":"http://www.huawei.com/en/psirt/security-notices/huawei-sn-20190515-01-windows-en","tags":["Third Party Advisory"],"source":"secure@microsoft.com"},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-166360.pdf","tags":["Third Party Advisory"],"source":"secure@microsoft.com"},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-406175.pdf","tags":["Third Party Advisory"],"source":"secure@microsoft.com"},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-433987.pdf","tags":["Third Party Advisory"],"source":"secure@microsoft.com"},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-616199.pdf","tags":["Third Party Advisory"],"source":"secure@microsoft.com"},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-832947.pdf","tags":["Third Party Advisory"],"source":"secure@microsoft.com"},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-932041.pdf","tags":["Third Party Advisory"],"source":"secure@microsoft.com"},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708","tags":["Patch","Vendor Advisory"],"source":"secure@microsoft.com"},{"url":"http://packetstormsecurity.com/files/153133/Microsoft-Windows-Remote-Desktop-BlueKeep-Denial-Of-Service.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://packetstormsecurity.com/files/153627/Microsoft-Windows-RDP-BlueKeep-Denial-Of-Service.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://packetstormsecurity.com/files/154579/BlueKeep-RDP-Remote-Windows-Kernel-Use-After-Free.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://packetstormsecurity.com/files/155389/Microsoft-Windows-7-x86-BlueKeep-RDP-Use-After-Free.html","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://packetstormsecurity.com/files/162960/Microsoft-RDP-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190529-01-windows-en","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.huawei.com/en/psirt/security-notices/huawei-sn-20190515-01-windows-en","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-166360.pdf","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-406175.pdf","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-433987.pdf","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-616199.pdf","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-832947.pdf","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-932041.pdf","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708","tags":["Patch","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0708","tags":["US Government Resource"],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-0708","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}