{"id":"CVE-2019-0708","published":"2019-05-16T19:29:00Z","modified":"2026-06-17T02:08:44Z","title":"Microsoft Remote Desktop Services Remote Code Execution Vulnerability","vendor":"Microsoft","product":"Remote Desktop Services","tier":"core","eol":null,"description":{"text":"A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.","provenance":"source","from":"NVD"},"summary":{"text":"A use-after-free flaw in Microsoft Remote Desktop Services (formerly Terminal Services) allows remote code execution. An unauthenticated attacker with network access to the target can connect using RDP and send specially crafted requests, requiring no user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:54:37Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99999,"percentile":0.99999,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-0708","provenance":"source"},"vulncheckKev":{"dateAdded":"2019-08-01","exploitedFirstSeen":"2019-08-01","ransomware":true,"evidence":[{"url":"https://securelist.com/apt-trends-report-q2-2019/91897/","date":"2019-08-01"},{"url":"https://www.microsoft.com/en-us/security/blog/2019/11/07/the-new-cve-2019-0708-rdp-exploit-attacks-explained/","date":"2019-11-07"},{"url":"https://blog.sonicwall.com/en-us/2019/12/top-cves-exploited-in-the-wild-in-the-year-2019/","date":"2019-12-27"},{"url":"https://go.group-ib.com/rs/689-LRE-818/images/Group-IB_Ransomware_Uncovered_whitepaper_eng.pdf","date":"2020-05-27"},{"url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf","date":"2020-06-18"},{"url":"https://dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/evolution-ransomware-gangs-pdf-9-w-6821.pdf","date":"2020-09-18"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa20-275a","date":"2020-10-20"},{"url":"https://media.defense.gov/2020/Oct/20/2002519884/-1/-1/0/CSA_CHINESE_EXPLOIT_VULNERABILITIES_UOO179811.PDF","date":"2020-10-20"},{"url":"https://us-cert.cisa.gov/ncas/alerts/aa20-275a","date":"2020-10-20"},{"url":"https://unit42.paloaltonetworks.com/network-attack-trends-winter-2020/","date":"2021-04-12"}],"evidenceTotal":55,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-416","name":"Use After Free"}],"references":[{"url":"http://packetstormsecurity.com/files/153133/Microsoft-Windows-Remote-Desktop-BlueKeep-Denial-Of-Service.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/153627/Microsoft-Windows-RDP-BlueKeep-Denial-Of-Service.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/154579/BlueKeep-RDP-Remote-Windows-Kernel-Use-After-Free.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/155389/Microsoft-Windows-7-x86-BlueKeep-RDP-Use-After-Free.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/162960/Microsoft-RDP-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190529-01-windows-en","tags":["Third Party Advisory"]},{"url":"http://www.huawei.com/en/psirt/security-notices/huawei-sn-20190515-01-windows-en","tags":["Third Party Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-166360.pdf","tags":["Third Party Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-406175.pdf","tags":["Third Party Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-433987.pdf","tags":["Third Party Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-616199.pdf","tags":["Third Party Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-832947.pdf","tags":["Third Party Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-932041.pdf","tags":["Third Party Advisory"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708","tags":["Patch","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/153133/Microsoft-Windows-Remote-Desktop-BlueKeep-Denial-Of-Service.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/153627/Microsoft-Windows-RDP-BlueKeep-Denial-Of-Service.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/154579/BlueKeep-RDP-Remote-Windows-Kernel-Use-After-Free.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/155389/Microsoft-Windows-7-x86-BlueKeep-RDP-Use-After-Free.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/162960/Microsoft-RDP-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190529-01-windows-en","tags":["Third Party Advisory"]},{"url":"http://www.huawei.com/en/psirt/security-notices/huawei-sn-20190515-01-windows-en","tags":["Third Party Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-166360.pdf","tags":["Third Party Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-406175.pdf","tags":["Third Party Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-433987.pdf","tags":["Third Party Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-616199.pdf","tags":["Third Party Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-832947.pdf","tags":["Third Party Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-932041.pdf","tags":["Third Party Advisory"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0708","tags":["US Government Resource"]}],"techniques":[{"id":"T1133","name":"External Remote Services","tactics":["initial-access","persistence"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"exploitation_technique","evidence":[],"comment":"CVE-2019-0708, also known as BlueKeep, is a remote code execution vulnerability present in the Windows Remote Desktop Services. Blue Keep can enable remote unauthenticated attackers to run arbitrary code, or conduct denial of service attacks, as well as potentially take control of vulnerable systems.","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1059.004","name":"Unix Shell","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"primary_impact","evidence":[],"comment":"CVE-2019-0708, also known as BlueKeep, is a remote code execution vulnerability present in the Windows Remote Desktop Services. Blue Keep can enable remote unauthenticated attackers to run arbitrary code, or conduct denial of service attacks, as well as potentially take control of vulnerable systems.","confidence":"low","confidenceNote":"technique is for ESXi, Linux, Network Devices, macOS; product runs on Windows"},{"id":"T1498","name":"Network Denial of Service","tactics":["impact"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2019-0708, also known as BlueKeep, is a remote code execution vulnerability present in the Windows Remote Desktop Services. Blue Keep can enable remote unauthenticated attackers to run arbitrary code, or conduct denial of service attacks, as well as potentially take control of vulnerable systems.","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1574","name":"Hijack Execution Flow","tactics":["execution","stealth"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"}],"reports":[{"id":"SRC-9411ade85d96fe0246ff","title":"Prioritizing “critical” vulnerabilities: A threat intelligence perspective","publisher":"Intel 471","url":"https://github.com/boschresearch/anno-ctr-lrec-coling-2024/blob/d510b6949e1938d47c93a43eedd562dc538439dc/AnnoCTR/text/train/intel471_2020-08-12_prioritizing-critical-vulnerabilities-a-threat.txt","date":"2020-08-12","mentions":[{"quote":"There was an extensive amount of open source coverage of this vulnerability, which referenced risk scoring previously assigned to the BlueKeep vulnerability CVE-2019-0708.","start":12254,"end":12425}]},{"id":"SRC-7b8e8d0c3a78be808510","title":"ESET InvisiMole","publisher":"web-assets.esetstatic.com","url":"https://web-assets.esetstatic.com/wls/2020/06/ESET_InvisiMole.pdf","date":null,"mentions":[{"quote":"We have observed InvisiMole using the BlueKeep and EternalBlue vulnerabilities (CVE-2019-0708 and","start":37331,"end":37428}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-1468","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-1468","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[{"id":46946,"url":"https://www.exploit-db.com/exploits/46946","title":"Microsoft Windows Remote Desktop - 'BlueKeep' Denial of Service","type":"dos","platform":"windows","date":"2019-05-30","verified":false,"provenance":"source"},{"id":47120,"url":"https://www.exploit-db.com/exploits/47120","title":"Microsoft Windows Remote Desktop - 'BlueKeep' Denial of Service (Metasploit)","type":"dos","platform":"windows","date":"2019-07-15","verified":false,"provenance":"source"},{"id":47120,"url":"https://www.exploit-db.com/exploits/47120","title":"Microsoft Windows Remote Desktop - 'BlueKeep' Denial of Service (Metasploit)","type":"dos","platform":"windows","date":"2019-07-15","verified":false,"provenance":"source"},{"id":47416,"url":"https://www.exploit-db.com/exploits/47416","title":"Microsoft Windows - BlueKeep RDP Remote Windows Kernel Use After Free (Metasploit)","type":"remote","platform":"windows","date":"2019-09-24","verified":true,"provenance":"source"},{"id":47416,"url":"https://www.exploit-db.com/exploits/47416","title":"Microsoft Windows - BlueKeep RDP Remote Windows Kernel Use After Free (Metasploit)","type":"remote","platform":"windows","date":"2019-09-24","verified":true,"provenance":"source"},{"id":47683,"url":"https://www.exploit-db.com/exploits/47683","title":"Microsoft Windows 7 (x86) - 'BlueKeep' Remote Desktop Protocol (RDP) Remote Windows Kernel Use After Free","type":"remote","platform":"windows_x86","date":"2019-11-19","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":6,"earliest":"2019-05-30"},"pocGithub":{"count":113,"skipped":9,"earliest":"2019-05-14","earliestUrl":"https://github.com/hook-s3c/CVE-2019-0708-poc","repos":[{"name":"Ekultek/BlueKeep","url":"https://github.com/Ekultek/BlueKeep","stars":1186,"created":"2019-05-29"},{"name":"robertdavidgraham/rdpscan","url":"https://github.com/robertdavidgraham/rdpscan","stars":922,"created":"2019-05-23"},{"name":"n1xbyte/CVE-2019-0708","url":"https://github.com/n1xbyte/CVE-2019-0708","stars":495,"created":"2019-05-21"},{"name":"k8gege/CVE-2019-0708","url":"https://github.com/k8gege/CVE-2019-0708","stars":388,"created":"2019-05-15"},{"name":"algo7/bluekeep_CVE-2019-0708_poc_to_exploit","url":"https://github.com/algo7/bluekeep_CVE-2019-0708_poc_to_exploit","stars":342,"created":"2019-05-31"}]},"metasploit":[{"name":"CVE-2019-0708 BlueKeep Microsoft Remote Desktop RCE Check","module":"auxiliary/scanner/rdp/cve_2019_0708_bluekeep","type":"auxiliary","disclosureDate":"2019-05-14","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/rdp/cve_2019_0708_bluekeep.rb"},{"name":"CVE-2019-0708 BlueKeep RDP Remote Windows Kernel Use After Free","module":"exploit/windows/rdp/cve_2019_0708_bluekeep_rce","type":"exploit","disclosureDate":"2019-05-14","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/rdp/cve_2019_0708_bluekeep_rce.rb"}],"first":{"date":"2019-05-14","source":"PoC-in-GitHub","url":"https://github.com/hook-s3c/CVE-2019-0708-poc"},"provenance":"source"},"detections":{"cveRules":[{"title":"Scanner PoC for CVE-2019-0708 RDP RCE Vuln","id":"8400629e-79a9-4737-b387-5db940ab2367","level":"high","status":"test","path":"rules-emerging-threats/2019/Exploits/CVE-2019-0708/win_security_exploit_cve_2019_0708_scanner_poc.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Exploits/CVE-2019-0708/win_security_exploit_cve_2019_0708_scanner_poc.yml","techniques":["T1210"]},{"title":"Potential RDP Exploit CVE-2019-0708","id":"aaa5b30d-f418-420b-83a0-299cb6024885","level":"medium","status":"test","path":"rules-emerging-threats/2019/Exploits/CVE-2019-0708/win_system_exploit_cve_2019_0708.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Exploits/CVE-2019-0708/win_system_exploit_cve_2019_0708.yml","techniques":["T1210"]}]},"exploitRefs":["http://packetstormsecurity.com/files/153133/Microsoft-Windows-Remote-Desktop-BlueKeep-Denial-Of-Service.html","http://packetstormsecurity.com/files/153627/Microsoft-Windows-RDP-BlueKeep-Denial-Of-Service.html","http://packetstormsecurity.com/files/154579/BlueKeep-RDP-Remote-Windows-Kernel-Use-After-Free.html","http://packetstormsecurity.com/files/162960/Microsoft-RDP-Remote-Code-Execution.html","http://packetstormsecurity.com/files/155389/Microsoft-Windows-7-x86-BlueKeep-RDP-Use-After-Free.html"],"flow":[{"stage":"exploitation","techniques":["T1133"],"provenance":"source"},{"stage":"secondary","techniques":["T1498"],"provenance":"source"},{"stage":"related","techniques":["T1059.004","T1574","T1068"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2019-05-14","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2019-05-14, Exploit-DB 2019-05-30","url":"https://github.com/hook-s3c/CVE-2019-0708-poc","provenance":"source"},{"date":"2019-05-16","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-0708","provenance":"source"},{"date":"2019-08-01","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://securelist.com/apt-trends-report-q2-2019/91897/","provenance":"source"},{"date":"2020-08-12","kind":"report","label":"Named in Intel 471: Prioritizing “critical” vulnerabilities: A threat intelligence perspective","url":"https://github.com/boschresearch/anno-ctr-lrec-coling-2024/blob/d510b6949e1938d47c93a43eedd562dc538439dc/AnnoCTR/text/train/intel471_2020-08-12_prioritizing-critical-vulnerabilities-a-threat.txt","provenance":"machine"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-1468","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":902},"priority":{"score":86.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2647 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 1.0000"},{"name":"Named in threat reports","points":6.13,"detail":"2 reports"},{"name":"Public exploit code","points":5.0,"detail":"4 NVD references tagged Exploit; 6 Exploit-DB entries; 1 NVD exploit link; 113 PoC-in-GitHub repos; 2 Metasploit modules"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}