CySec
en
  1. Home
  2. Blog
  3. Vulnerabilities & CVE

BlueKeep (CVE-2019-0708): the wormable Remote Desktop flaw

A pre-authentication bug in Remote Desktop Services was so serious that Microsoft even patched Windows XP. Why RDP must never face the internet.

3 min read

Publicly disclosed: 14 May 2019

In May 2019 Microsoft fixed a vulnerability in Remote Desktop Services that allowed an unauthenticated attacker to run code just by connecting to RDP. Because it needed no user action, it was “wormable” — able to spread from computer to computer like WannaCry. Microsoft took the unusual step of releasing patches for out-of-support Windows XP and Server 2003.

CVESeverityAffectedFixed in
CVE-2019-0708Critical, CVSS 9.8 (remote code execution)Windows XP, 7, Server 2003, 2008, 2008 R2May 2019 security updates

How to protect

  1. Install updates and retire unsupported Windows versions.
  2. Never expose RDP (port 3389) directly to the internet — use VPN or Remote Desktop Gateway with MFA.
  3. Enable Network Level Authentication: it requires a login before the vulnerable code is reached (a partial mitigation).
  4. Block RDP between workstations where it is not needed.

Good Windows patching habits

  • Install Patch Tuesday updates (second Tuesday of every month) within days for internet-facing systems and within two weeks for the rest.
  • Watch for out-of-band updates — Microsoft releases them only for serious issues.
  • Replace Windows versions that no longer receive security updates.

Sources: Microsoft CVE-2019-0708, NVD CVE-2019-0708.

Need help with this? Contact CySec for a free consultation.

Tags:#Windows

All articles

More on this topic

All articles in this topic
12 November 2026· 3 min read

N-able N-central “4EverAble2Shell” zero-day: when the remote management server is the target

A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.

Read article
10 November 2026· 4 min read

Outlook zero-day CVE-2026-124194 and November 2026 Patch Tuesday: what to update first

An exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.

Read article
9 November 2026· 3 min read

Chrome zero-day CVE-2026-125350: update the browser and restart it

Google fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.

Read article

Need help with this?

Our engineers can review your current setup and propose concrete improvements.

Request a quote
WhatsApp+374 33 870717 Emailinfo@cysec.am