Skip to content
skopnix
Dossier · Vulnerability

Actively exploited · CISA KEV · NVD published 2019-05-16

CVE-2019-0708

A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.

  1. First PoC
  2. 2491 days →Metasploit
  3. 207 days →First cited attacker

Signals

Exploited in the wild
Yesadded 2021-11-03 · due 2022-05-03 · known ransomware use. An observation, not a forecast.
EPSS · 30-day forecast
100.0%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · CRITICAL
9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Internet exposure
not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

6 known · links only

Metasploit2

  1. CVE-2019-0708 BlueKeep Microsoft Remote Desktop RCE Check ↗

    This module checks a range of hosts for the CVE-2019-0708 vulnerability by binding the MS_T120 channel outside of its normal slot and sending non-DoS packets which respond differently on patched and vulnerable hosts. It can optionally trigger the DoS vulnerability.

    ruby · seen 2026-10-18

  2. CVE-2019-0708 BlueKeep RDP Remote Windows Kernel Use After Free ↗

    The RDP termdd.sys driver improperly handles binds to internal-only channel MS_T120, allowing a malformed Disconnect Provider Indication message to cause use-after-free. With a controllable data/size remote nonpaged pool spray, an indirect call gadget of the freed channel is used to achieve arbitrary code execution. Windows 7 SP1 and Windows Server 2008 R2 are the only currently supported targets. Windows 7 SP1 should be exploitable in its defa

    ruby · seen 2026-10-18

Exploit-DB4

  1. Microsoft Windows Remote Desktop - 'BlueKeep' Denial of Service ↗

    created 2019-05-30

  2. Microsoft Windows Remote Desktop - 'BlueKeep' Denial of Service (Metasploit) ↗

    created 2019-07-15

  3. Microsoft Windows - BlueKeep RDP Remote Windows Kernel Use After Free (Metasploit) ↗

    created 2019-09-24

  4. Microsoft Windows 7 (x86) - 'BlueKeep' Remote Desktop Protocol (RDP) Remote Windows Kernel Use After Free ↗

    created 2019-11-19

On the wire

0 dispatches

No dispatch on our wire has named this CVE yet.

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.