← Vulnerability Intelligence

CVE-2019-0708

Critical 9.8 Exploited in the wild (KEV) Used in ransomware campaigns

Confirmed active exploitation — CISA KEV catalog

Name
Microsoft Remote Desktop Services Remote Code Execution Vulnerability
Added to catalog
Remediation due date (US federal)
Required action
Apply updates per vendor instructions.

Description

A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.

Metrics

CVSS 3.1
9.8 (CRITICAL) Score source: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS — exploit probability
100% (percentile: 100) as of 2 November 2026
CWE
CWE-416

Affected products

microsoft: windows 7; microsoft: windows server 2008; siemens: axiom multix m firmware; siemens: axiom multix m; siemens: axiom vertix md trauma firmware; siemens: axiom vertix md trauma; siemens: axiom vertix solitaire m firmware; siemens: axiom vertix solitaire m; siemens: mobilett xp digital firmware; siemens: mobilett xp digital; siemens: multix pro acss p firmware; siemens: multix pro acss p; siemens: multix pro p firmware; siemens: multix pro p; siemens: multix pro firmware

References