September 2026 CVE Landscape
Recorded Future says 80 vulnerabilities were actively exploited in September 2026, including NetScaler zero-days.
85
CVE-2019-0708
Unauthenticated RCE in Microsoft Remote Desktop Services (BlueKeep)
CISA: Microsoft Remote Desktop Services Remote Code Execution Vulnerability
- CVSS 3.1
- 9.8 critical
- EPSS
- 100%p100
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
CVE-2019-0708 is a use-after-free (CWE-416) vulnerability in Microsoft Remote Desktop Services, formerly Terminal Services, in which an unauthenticated attacker can connect to a target system over RDP and send specially crafted requests to trigger the flaw. Because the trigger requires no authentication, the flaw is wormable: a successful exploit grants remote code execution on the target host, potentially with elevated privileges, and could allow self-propagating attacks similar to WannaCry. Organizations running the affected Microsoft Remote Desktop Services, particularly legacy Windows releases still accepting inbound RDP connections, are in scope. Exploitation is confirmed in the wild: the flaw (nicknamed BlueKeep) is listed in CISA's KEV catalog (added 2021-11-03), CISA notes known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days.
What to do: Apply Microsoft's security updates for CVE-2019-0708 per vendor instructions, prioritizing legacy or end-of-support Windows systems exposed to inbound RDP. As mitigation, restrict RDP (TCP 3389) to trusted networks or VPN access, require Network Level Authentication (NLA), and audit perimeter firewalls and public scans for open RDP listeners. The vulnerability is in the CISA KEV catalog, so patching is treated as a required action for federal and high-risk environments.
| Product | Affected |
|---|---|
| Microsoft Remote Desktop Services | — |
Estimated exposure
masson the order of millions of internet-exposed RDP endpoints and far more internal systems — Public internet-wide scans of open RDP (TCP 3389) have repeatedly shown millions of exposed endpoints, and the enormous installed base of legacy Windows systems with Remote Desktop Services enabled makes this a mass-scale exposure.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.
KEVCISA Known Exploited Vulnerability
- Affected
- Microsoft Remote Desktop Services
- Required action
- Apply updates per vendor instructions.
- Due date
- Ransomware use
- Known
- Products
- windows 7, windows server 2008, axiom multix m firmware, axiom vertix md trauma firmware, axiom vertix solitaire m firmware, mobilett xp digital firmware, multix pro acss p firmware, multix pro p firmware, multix pro firmware, multix pro acss firmware, multix pro navy firmware, multix swing firmware
- Weakness
- CWE-416
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news
20 storiesThree Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers
Kaspersky details NightEagle, Hacking Cat, and Toy Ghouls targeting Russian enterprises with Exchange backdoors, Gorilla RAT, and destructive Monkey ransomware.
76
NightEagle Uses BlueKeep and DCSync to Move Toward Active Directory Domain Controllers
NightEagle espionage group used GhostContainer, BlueKeep exploitation, and DCSync attempts to compromise Russian organizations and target Active Directory controllers.
75
NightEagle Hackers Abuse Microsoft Dev Tunnels and GhostContainer to Breach Russian Companies
NightEagle (APT-Q-95) breached Russian firms using stolen VPN credentials, a GhostContainer Exchange backdoor, Dev Tunnels abuse, and DCSync.
74
NightEagle Hackers Target Russian Companies Using GhostContainer Backdoor
Kaspersky links NightEagle (APT-Q-95) intrusions in Russia to stolen VPN credentials, the GhostContainer Exchange backdoor, BlueKeep exploitation, and covert tunneling for espionage.
74
NightEagle targets Russian companies
Kaspersky links NightEagle (APT-Q-95) attacks on Russian firms to compromised VPN credentials, a GhostContainer Exchange backdoor, RDP tunneling, BlueKeep exploitation, and DCSync.
74
NightEagle Hackers Abuse Microsoft Dev Tunnels and GhostContainer to Breach Russian Companies
Kaspersky links NightEagle (APT-Q-95) intrusions in Russia to stolen VPN credentials, the GhostContainer Exchange backdoor, and Microsoft Dev Tunnels abuse.
72
The Week in Vulnerabilities: Toptech, Lantronix, Langflow, and CISA Malcolm Flaws
Cyble sensors logged exploitation attempts against about 20 flaws as CISA issued 14 ICS advisories.
68
60
60
60
60
60
60
60
60
60
60
60
60