Remote Desktop Services CVE-2019-0708
CRITICALVulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V14 - Configuration Dependency management, component inventory
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Extreme risk (CVSS 9.8, EPSS 94.5%). Microsoft issued an unprecedented patch for end-of-life Windows XP due to the severity. NSA published a rare advisory urging immediate patching. While a WannaCry-scale worm never materialized, active exploitation was confirmed, and the vulnerability remains dangerous for unpatched systems. |
| Exploit ScenarioDerived | An attacker scans for RDP services on port 3389, identifies vulnerable Windows versions, and sends crafted RDP connection requests that trigger the use-after-free in the kernel. Without any credentials, the attacker gains SYSTEM-level code execution on the target, with potential for automated worm propagation across networks. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 26, 2026
Remote Desktop Services contain a pre-authentication remote code execution vulnerability known as 'BlueKeep' that allows unauthenticated attackers to execute code via crafted RDP requests, with wormable potential rivaling EternalBlue.
Earlier versions of this analysis (1)
A critical pre-authentication remote code execution vulnerability in Remote Desktop Services (formerly Terminal Services), known as 'BlueKeep', allows unauthenticated network attackers to execute arbitrary code via crafted RDP requests. Microsoft rated it as wormable.
RemediationAI
Apply Microsoft security update immediately. Enable Network Level Authentication (NLA) as a partial mitigation. Disable RDP where not needed. Use VPN or jump servers for remote access instead of direct RDP exposure. Windows 8+ and Server 2012+ are not affected.
Affected ProductsAI
Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista SP2 Microsoft Windows Server 2008 SP2/R2 SP1 Microsoft Windows 7 SP1
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The CWE-416 use-after-free in the RDP protocol's channel handling occurs when a crafted connection request triggers improper handling of channel bindings. The vulnerability exists before authentication, meaning any system with RDP exposed can be exploited without credentials. The flaw is in the kernel-mode rdpwd.sys driver, providing SYSTEM-level code execution.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.
Executive ViewAI
CVE-2019-0708 presents critical security risk, a use-after-free vulnerability rated CVSS 9.8. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems. This vulnerability is actively exploited in the wild (KEV-listed) and requires immediate remediation. A patch is available and should be applied immediately given the critical severity.
Apply vendor patch. If immediate patching is not feasible: (1) Enable ASLR and DEP where available; (2) Implement network segmentation; (3) Monitor for exploitation indicators.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Exploit-DB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
GitHub PoC