Vulnerabilities/Microsoft/CVE-2019-0708

CVE-2019-0708: Microsoft Remote Desktop Services Remote Code Execution Vulnerability

CISA KEV entry · Last checked 30 Oct 2026, 12:10 UTC

Exploitation confirmedRansomware use knownFix: Unknown

CVSS 3.1 · NVD9.8Critical
EPSS100.0%100th percentile · 29 Oct 2026
CISA KEVListedAdded 3 Nov 2021

Microsoft Remote Desktop Services, formerly known as Terminal Service, contains an unspecified vulnerability that allows an unauthenticated attacker to connect to the target system using RDP and send specially crafted requests. Successful exploitation allows for remote code execution. The vulnerability is also known under the moniker of BlueKeep.

Recommended action

Apply updates per vendor instructions.

CISA due date 3 May 2022 · CWE-416

Vendor advisory ↗CISA KEV entry ↗

Am I affected?

ProductAffected versionsFixed in
Windows7 for 32-bit Systems Service Pack 1Unknown
Windows7 for x64-based Systems Service Pack 1Unknown
Windows Server2008 R2 for x64-based Systems Service Pack 1 (Core installation)Unknown
Windows Server2008 R2 for Itanium-Based Systems Service Pack 1Unknown
Windows Server2008 R2 for x64-based Systems Service Pack 1Unknown
Show 5 more rows
Windows Server2008 for 32-bit Systems Service Pack 2 (Core installation)Unknown
Windows Server2008 for Itanium-Based Systems Service Pack 2Unknown
Windows Server2008 for 32-bit Systems Service Pack 2Unknown
Windows Server2008 for x64-based Systems Service Pack 2Unknown
Windows Server2008 for x64-based Systems Service Pack 2 (Core installation)Unknown

No source states a fixed version. Check the vendor advisory below.

Before you patch

Restart

See vendor guidance.

Known issues

Check release notes.

Verification

Confirm installed version.

Timeline

  • 3 Nov 2021 · Added to CISA KEV
  • 3 May 2022 · CISA due date

References

Sources checked
CISA KEV30 Oct 2026, 12:10 UTC
CVE List v530 Oct 2026, 12:10 UTC
NVD30 Oct 2026, 12:10 UTC
FIRST EPSS30 Oct 2026, 12:11 UTC

Data from CISA, MITRE, NVD and FIRST. Sources and licences.