VulnRadar

Data against noise.

Built with NaN
Page generated: 07 Nov 2026, 04:40 UTC
← Dashboard

CVE-2019-0708

A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code Execution Vulnerabil…

Read full description
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.
CVSS 9.8 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
0.0/10
REALITY · THREAT PRIORITY
9.0/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 9.8: +1.47
  • Fresh EPSS: 100.00%: +0.50

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 43 documents and public datasets.

Hype components

Headline sample (25%)
0/100
Press, 30 days (60%)
0/100
Grounded branding (15%)
0/100
HYPE TOTAL0/100

Sources and documents

news.lavx.hu
Press · 02 Oct 2026, 04:37 · Law firm CISO's 'r3@lg00dp@$$w0rd' exposed after BlueKeep patch failure - news.lavx.hu
Huntress
Press · 21 Nov 2025, 08:00 · CVE-2019-0708 Vulnerability: Analysis, Impact, Mitigation - Huntress
Rescana
Press · 11 Aug 2025, 07:00 · North Korean Kimsuky Hackers Exploit BlueKeep Vulnerability in RDP Systems: Comprehensive Data Breach Analysis - Rescana
SentinelOne
Press · 27 Apr 2025, 07:00 · CVE-2019-0708: Background, Vulnerable Hosts, and Protection Strategies - SentinelOne
The Hacker News
Press · 21 Apr 2025, 07:00 · Kimsuky Exploits BlueKeep RDP Vulnerability to Breach Systems in South Korea and Japan - The Hacker News
See all 43 source documents
CyberSecurityNews
Press · 24 Mar 2025, 07:00 · New Browser-Based RDP for Secure Remote Windows Server Access - CyberSecurityNews
SentinelOne
Press · 01 Apr 2024, 07:00 · What’s New With Bluekeep? Are Your Devices Vulnerable? - SentinelOne
Unit 42
Press · 07 Dec 2020, 08:00 · Exploitation of Windows RDP Vulnerability CVE-2019-0708 (BlueKeep) - Unit 42
WeLiveSecurity
Press · 17 Dec 2019, 08:00 · Why it’s time to disconnect RDP from the internet - WeLiveSecurity
Proofpoint
Press · 21 Nov 2019, 08:00 · BlueKeep Vulnerability Explained: Why It Matters - Proofpoint
Tripwire
Press · 11 Nov 2019, 08:00 · BlueKeep: What you Need to Know - Tripwire
WeLiveSecurity
Press · 11 Nov 2019, 08:00 · First BlueKeep attacks prompt fresh warnings - WeLiveSecurity
Bitdefender
Press · 07 Nov 2019, 08:00 · Debunking The BlueKeep Exploit Hype – What You Should Know - Bitdefender
Cisco Talos Blog
Press · 04 Nov 2019, 08:00 · The latest on BlueKeep and DejaBlue vulnerabilities — Using Firepower to defend against encrypted DejaBlue - Cisco Talos Blog
WIRED
Press · 02 Nov 2019, 07:00 · The First BlueKeep Mass Hacking Is Finally Here—but Don't Panic - WIRED
Bitdefender
Press · 09 Sep 2019, 07:00 · BlueKeep Exploit Code Released, Blocked by Hypervisor Introspection - Bitdefender
Ars Technica
Press · 06 Sep 2019, 07:00 · Exploit for wormable BlueKeep Windows bug released into the wild - Ars Technica
Unit 42
Press · 29 Aug 2019, 07:00 · Exploitation of Windows CVE-2019-0708 (BlueKeep): Three Ways to Write Data into Kernel with RDP PDU - Unit 42
CCB Belgium
Press · 14 Aug 2019, 07:00 · Bluekeep: Windows RDP Remote Code Execution Vulnerability V2 - CCB Belgium
Redmondmag.com
Press · 13 Aug 2019, 07:00 · Microsoft's August Security Patches Address New RDP Vulnerabilities - Redmondmag.com
ZDNET
Press · 13 Aug 2019, 07:00 · Microsoft August 2019 Patch Tuesday fixes 93 security bugs - ZDNET
Microsoft
Press · 08 Aug 2019, 07:00 · Protect against BlueKeep - Microsoft
Rapid7
Press · 31 Jul 2019, 07:00 · BlueKeep RDP Vulnerability (CVE-2019-0708) Activity in the Wild - Rapid7
Bitsight
Press · 17 Jul 2019, 07:00 · Industry Response to the BlueKeep Vulnerability - Bitsight
Bitsight
Press · 20 Jun 2019, 07:00 · Will BlueKeep Become WannaCry 2.0? - Bitsight
Armis, The Cyber Exposure Management & Security Company
Press · 19 Jun 2019, 07:00 · Armis Identifies Devices with BlueKeep Vulnerabilities - Armis, The Cyber Exposure Management & Security Company
Bitsight
Press · 13 Jun 2019, 07:00 · Data Insights on the BlueKeep Vulnerability - Bitsight
BleepingComputer
Press · 05 Jun 2019, 07:00 · MetaSploit Module Created for BlueKeep Flaw, Private for Now - BleepingComputer
Huntress
Press · 04 Jun 2019, 07:00 · Keeping up with BlueKeep - Huntress
National Security Agency (NSA) (.gov)
Press · 04 Jun 2019, 07:00 · NSA Cybersecurity Advisory: Patch Remote Desktop Services on Legacy Versions of Windows - National Security Agency (NSA) (.gov)
www.extremetech.com
Press · 31 May 2019, 07:00 · A Million PCs May Be Vulnerable to BlueKeep Malware, Microsoft Urges Users to Patch - www.extremetech.com
WIRED
Press · 31 May 2019, 07:00 · Microsoft's BlueKeep Bug Isn't Getting Patched Fast Enough - WIRED
Cisco Talos Blog
Press · 31 May 2019, 07:00 · Using Firepower to defend against encrypted RDP attacks like BlueKeep - Cisco Talos Blog
Check Point Blog
Press · 28 May 2019, 07:00 · SandBlast Agent Protects Against BlueKeep RDP Vulnerability - Check Point Blog
thezdi.com
Press · 28 May 2019, 07:00 · CVE-2019-0708: A Comprehensive Analysis of a Remote Desktop Services Vulnerability - thezdi.com
BleepingComputer
Press · 24 May 2019, 07:00 · BlueKeep RCE Flaw Gets Micropatch for Always-On Servers - BleepingComputer
Ars Technica
Press · 23 May 2019, 07:00 · Why a Windows flaw patched nine days ago is still spooking the Internet - Ars Technica
BleepingComputer
Press · 22 May 2019, 07:00 · Researchers Demo PoC For Remote Desktop BlueKeep RCE Exploit - BleepingComputer
WeLiveSecurity
Press · 22 May 2019, 07:00 · Patch now! Why the BlueKeep vulnerability is a big deal - WeLiveSecurity
Trellix
Press · 21 May 2019, 07:00 · RDP Stands for "Really Do Patch!" - Understanding the Wormable RDP Vulnerability CVE-2019-0708 - Trellix
SOC Prime
Press · 20 May 2019, 07:00 · Proactive detection content: CVE-2019-0708 vs ATT&CK, Sigma, Elastic and ArcSight - SOC Prime
Qualys
Press · 15 May 2019, 07:00 · Windows RDP Remote Code Execution Vulnerability (BlueKeep) – How to Detect and Patch - Qualys
Krebs on Security
Press · 14 May 2019, 07:00 · Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003 - Krebs on Security

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 9.0 (2026-11-02 15:12). The curve appears once the score changes.

Public exploit evidence

31

Public exploit entries / repo candidates

See 30 repos with metrics
RepositoryStarsForksLanguageUpdated
k8gege/CVE-2019-0708388186Python13 Jun 2019, 13:07
algo7/bluekeep_CVE-2019-0708_poc_to_exploit342123Python10 Jan 2021, 04:31
Leoid/CVE-2019-070812636Python28 May 2019, 02:46
biggerwing/CVE-2019-0708-poc8230Python30 May 2019, 02:43
hook-s3c/CVE-2019-0708-poc4723—15 May 2019, 14:23
syriusbughunt/CVE-2019-07083817—16 May 2019, 02:12
jiansiting/CVE-2019-07081914Python01 Jun 2019, 04:12
cvencoder/cve-2019-0708141—24 Jun 2019, 16:03
closethe/CVE-2019-0708-POC137Python24 May 2019, 09:03
skyshell20082008/CVE-2019-0708-PoC-Hitting-Path1296Python19 May 2019, 17:47
NullByteSuiteDevs/CVE-2019-070863Python15 May 2019, 16:24
ht0Ruial/CVE-2019-0708Poc-BatchScanning43—28 May 2019, 17:16
andripwn/CVE-2019-070832C20 Sep 2020, 14:29
victor0013/CVE-2019-07083360C22 May 2019, 02:13
edvacco/CVE-2019-0708-POC210Python21 May 2019, 07:51
skommando/CVE-2019-070822Python12 Sep 2019, 02:29
smallFunction/CVE-2019-0708-POC222Python23 May 2019, 17:02
303sec/CVE-2019-070811Python17 May 2019, 08:34
adyanamul/Remote-Code-Execution-RCE-Exploit-BlueKeep-CVE-2019-0708-PoC10Python02 Jun 2024, 12:08
CircuitSoul/CVE-2019-070810Python19 Jun 2021, 21:57
herhe/CVE-2019-0708poc10—27 May 2019, 09:42
lp008/CVE_2019_0708_Blue_screen_poc11Python31 May 2019, 06:50
ntkernel0/CVE-2019-070815Python25 Jul 2019, 01:03
sbkcbig/CVE-2019-0708-Poc-exploit10—15 May 2019, 20:26
AaronCaiii/CVE-2019-0708-POC00Python06 Nov 2020, 08:07
f8al/CVE-2019-0708-POC01Python28 May 2019, 22:20
freeide/CVE-2019-0708-PoC-Exploit00—23 May 2019, 15:56
isabelacostaz/CVE-2019-0708-POC00Python30 Apr 2025, 13:50
yetiddbb/CVE-2019-0708-PoC00—15 May 2019, 02:03
ZhaoYukai/CVE-2019-070800Python31 May 2019, 08:02
Public exploit evidence
Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 9.8; EPSS 100.0%
Attention, last 30 days
0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential
network access, no prior privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:58:02.857210+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
First press mention
14 May 2019, 07:00
Published
16 May 2019, 18:17
Added to the CISA KEV catalog
03 Nov 2021, 00:00
Latest press mention
02 Oct 2026, 04:37
Score calculated
05 Nov 2026, 13:58
PoCs on GitHub
31 repositories
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar