Microsoft RDP RCE

CVE-2019-0708 is a use-after-free in termdd.sys, the kernel-mode driver behind Remote Desktop Services. A remote, unauthenticated attacker sends a crafted request over channel MS_T120 during RDP protocol setup — before any credential prompt — and gains SYSTEM-level code execution in ring 0. Affected: Windows XP, Windows Server 2003, Windows 7 SP1, Windows Server 2008, and Windows Server 2008 R2. Windows 8/2012 and later are not vulnerable due to changes in how virtual channels are bound.

The vendor CRITICAL rating is entirely correct and if anything understated by the CVSS number. This bug is wormable (Microsoft compared it to EternalBlue), requires no authentication, no user interaction, and delivers kernel RCE against the single most-exposed remote-management protocol in the Windows ecosystem. Microsoft took the extraordinary step of shipping a patch for out-of-support Windows XP and Server 2003 — they only do that when they think the internet is about to burn.

Why this verdict

• KEV-listed and actively exploited: CISA added this to KEV in 2021 based on confirmed in-the-wild use. Cryptomining crews weaponized it within months of disclosure.
• Pre-auth, network-adjacent, wormable: No credentials, no user interaction, one packet against TCP/3389 — the exact profile that produced WannaCry.
• Role multiplier — legacy Windows servers: In 2026 the affected OS footprint is disproportionately RDP jump boxes, OT/HMIs, medical imaging consoles, ATMs, POS controllers, and unmanaged Server 2008 R2 line-of-business hosts. Compromise of any one of these is fleet-scale or safety-scale, not local.
• Role multiplier — domain-joined legacy hosts: SYSTEM on a domain-joined Server 2008 R2 is a straight path to cached credentials, DPAPI secrets, and lateral movement to a DC. The chain ends in domain compromise. Floor is CRITICAL.
• Friction is limited: NLA mitigates but is not universally deployed on the affected OS versions; the Metasploit exploit is unreliable, but nation-state and mature crime groups don't use the public module.

Why not higher?

CRITICAL / 9.8 is already the top of the scale under CVSS 3.1. There is no higher bucket to promote to.

Why not lower?

Downgrading would require ignoring KEV status, ignoring the wormable pre-auth vector, and ignoring the concentration of the affected OS footprint in high-value roles (OT, jump boxes, domain-joined legacy servers). Even in 2026, the Shodan long tail and the OT reality make this a legitimate CRITICAL. The unreliability of the public Metasploit module is a speed bump, not a mitigation.

1. Enable Network Level Authentication (NLA) on every remaining RDS host — NLA forces CredSSP authentication before the vulnerable virtual-channel setup runs, breaking the exploit path. Set via GPO Computer Configuration → Admin Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host → Security → Require user authentication for remote connections by using NLA. Deploy within 3 days per the noisgate CRITICAL mitigation SLA.
2. Block TCP/3389 at the perimeter and force RDP through a bastion/VPN with MFA — Removes internet-reachable exposure entirely. Confirm via external attack-surface tooling (Censys, Shodan Monitor) that no 3389/UDP-3389 endpoints resolve to your ASN. Complete within 3 days.
3. Segment legacy Windows OT / medical / kiosk hosts onto isolated VLANs — The 2026 vulnerable population is concentrated in OT, medical, retail, and industrial fleets that cannot be patched. Wrap them in strict east-west ACLs so only named jump hosts can reach 3389. Complete within 30 days.
4. Disable Remote Desktop Services where not required — Set-Service TermService -StartupType Disabled; Stop-Service TermService on hosts that don't need it. Fastest permanent fix.
5. Apply KB4499164 / KB4499175 / KB4499180 (or the XP/2003 out-of-band patch) — The permanent fix. Remediate every affected host within 90 days per the noisgate CRITICAL remediation SLA.

Run on the target Windows host as a local Administrator (needed to read installed hotfixes and the RDP NLA registry setting). Invoke: powershell -ExecutionPolicy Bypass -File .\Check-BlueKeep.ps1. For fleet-wide use, wrap in Invoke-Command -ComputerName (Get-Content hosts.txt) -FilePath .\Check-BlueKeep.ps1.

#requires -RunAsAdministrator
# Check-BlueKeep.ps1 — CVE-2019-0708 (BlueKeep) presence check
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN / not applicable

$ErrorActionPreference = 'Stop'

try {
    $os = Get-CimInstance Win32_OperatingSystem
    $ver = [Version]$os.Version
    $caption = $os.Caption

    # Only XP, 2003, Win7, Server 2008, Server 2008 R2 are vulnerable
    $affected = $false
    if ($ver.Major -eq 5) { $affected = $true }                        # XP / 2003
    elseif ($ver.Major -eq 6 -and $ver.Minor -in 0,1) { $affected = $true }  # Vista/2008/Win7/2008R2

    if (-not $affected) {
        Write-Host "PATCHED — $caption is not in the affected OS family"
        exit 0
    }

    # Fixing KBs from MS advisory (May 2019 + follow-ups)
    $fixKBs = @('KB4499164','KB4499175','KB4499180','KB4500331',
                'KB4501226','KB4503273','KB4503292','KB4507449','KB4507456')

    $installed = Get-HotFix -ErrorAction SilentlyContinue | Select-Object -ExpandProperty HotFixID
    $found = $fixKBs | Where-Object { $installed -contains $_ }

    # NLA state — mitigates even if unpatched
    $nla = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication

    if ($found) {
        Write-Host "PATCHED — hotfix present: $($found -join ', ')"
        exit 0
    }
    elseif ($nla -eq 1) {
        Write-Host "VULNERABLE (mitigated) — no BlueKeep hotfix, but NLA is enabled. Patch anyway."
        exit 1
    }
    else {
        Write-Host "VULNERABLE — no BlueKeep hotfix and NLA disabled. Exploitable."
        exit 1
    }
}
catch {
    Write-Host "UNKNOWN — $($_.Exception.Message)"
    exit 2
}

Sources

1. Microsoft MSRC — CVE-2019-0708 advisory
2. NVD — CVE-2019-0708
3. CISA KEV Catalog
4. Metasploit BlueKeep RCE module
5. zerosum0x0 / CVE-2019-0708 PoC
6. Microsoft — DART on BlueKeep in the wild
7. NCSC UK advisory
8. Tenable plugin 125313