CVE-2019-0708

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

VendorProductVersions
MicrosoftWindows7 for 32-bit Systems Service Pack 1; 7 for x64-based Systems Service Pack 1
MicrosoftWindows Server2008 R2 for x64-based Systems Service Pack 1 (Core installation); 2008 R2 for Itanium-Based Systems Service Pack 1; 2008 R2 for x64-based Systems Service Pack 1; 2008 for 32-bit Systems Service Pack 2 (Core installation); 2008 for Itanium-Based Systems Service Pack 2; 2008 for 32-bit Systems Service Pack 2; 2008 for x64-based Systems Service Pack 2; 2008 for x64-based Systems Service Pack 2 (Core installation)

References

Timeline

Published
May 16, 2019
Last modified
Jun 17, 2026
Added to CISA KEV
Nov 3, 2021
NVD status
Analyzed

Related CVEs from 2019

CVE-2019-07097.6A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated usCVE-2019-07106.8A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on CVE-2019-07116.8A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on CVE-2019-07126.8A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privCVE-2019-07136.8A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on CVE-2019-07145.8A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privCVE-2019-07155.8A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privCVE-2019-07165.8A denial of service vulnerability exists when Windows improperly handles objects in memory. An attacker who successfully exploited the vulneCVE-2019-07175.8A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privCVE-2019-07185.8A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privCVE-2019-07199.1A remote code execution vulnerability exists when Windows Hyper-V Network Switch on a host server fails to properly validate input from an aCVE-2019-07208.0A remote code execution vulnerability exists when Windows Hyper-V Network Switch on a host server fails to properly validate input from an a
CVE-2019-0708: Critical severity, CVSS 9.8 | Vulnix