Is CVE-2019-0708 being actively exploited?

Yes. CVE-2019-0708 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on November 3, 2021.

What is the CVSS score for CVE-2019-0708?

CVE-2019-0708 has a CVSS 3.1 base score of 9.8 (CRITICAL).

CVE-2019-0708

CRITICAL · CVSS 9.8CISA KEV: actively exploitedEPSS 100.0%EU EUVD: exploited

A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.

Key facts

CVSS score: 9.8 (v3.1)
Severity: CRITICAL
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-416
EPSS score: 100.0% (100th percentile)
In CISA KEV: Yes, added November 3, 2021
In EU EUVD: Yes (EUVD-2019-1468)
Published: May 16, 2019
NVD last modified: June 17, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Microsoft Remote Desktop Services Remote Code Execution Vulnerability

Added to the KEV catalog on November 3, 2021; federal remediation due May 3, 2022. Known to be used in ransomware campaigns.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2019-1468 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on October 21, 2025.

View on the EU Vulnerability Database

Affected products

huawei / agile controller-campus
huawei / agile controller-campus firmware
huawei / agile controller-campus firmware
huawei / bh620 v2
huawei / bh620 v2 firmware
huawei / bh621 v2
huawei / bh621 v2 firmware
huawei / bh622 v2
huawei / bh622 v2 firmware
huawei / bh640 v2
huawei / bh640 v2 firmware
huawei / ch121
huawei / ch121 firmware
huawei / ch140
huawei / ch140 firmware
huawei / ch220
huawei / ch220 firmware
huawei / ch221
huawei / ch221 firmware
huawei / ch222
huawei / ch222 firmware
huawei / ch240
huawei / ch240 firmware
huawei / ch242
huawei / ch242 firmware
huawei / ch242 v3
huawei / ch242 v3 firmware
huawei / e6000
huawei / e6000 chassis
huawei / e6000 chassis firmware
huawei / e6000 firmware
huawei / elog
huawei / elog firmware
huawei / espace ecs
huawei / espace ecs firmware
huawei / gtsoftx3000
huawei / gtsoftx3000 firmware
huawei / gtsoftx3000 firmware
huawei / gtsoftx3000 firmware
huawei / oceanstor 18500
huawei / oceanstor 18500 firmware
huawei / oceanstor 18800
huawei / oceanstor 18800 firmware
huawei / oceanstor 18800f
huawei / oceanstor 18800f firmware
huawei / oceanstor hvs85t
huawei / oceanstor hvs85t firmware
huawei / oceanstor hvs85t firmware
huawei / oceanstor hvs88t
huawei / oceanstor hvs88t firmware

and 89 more…

Certified products that may be affected

2 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Windows 7 BitLocker™ Drive Encryption - Microsoft Corporation - FIPS 140 1332 - historical
Microsoft Windows 7 Kernel Mode Cryptographic Primitives Library (cng.sys) - Microsoft Corporation - FIPS 140 1328 - historical

References

http://packetstormsecurity.com/files/153133/Microsoft-Windows-Remote-Desktop-BlueKeep-Denial-Of-Service.html(Exploit, Third Party Advisory, VDB Entry)
http://packetstormsecurity.com/files/153627/Microsoft-Windows-RDP-BlueKeep-Denial-Of-Service.html(Exploit, Third Party Advisory, VDB Entry)
http://packetstormsecurity.com/files/154579/BlueKeep-RDP-Remote-Windows-Kernel-Use-After-Free.html(Exploit, Third Party Advisory, VDB Entry)
http://packetstormsecurity.com/files/155389/Microsoft-Windows-7-x86-BlueKeep-RDP-Use-After-Free.html(Third Party Advisory, VDB Entry)
http://packetstormsecurity.com/files/162960/Microsoft-RDP-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190529-01-windows-en(Third Party Advisory)
http://www.huawei.com/en/psirt/security-notices/huawei-sn-20190515-01-windows-en(Third Party Advisory)
https://cert-portal.siemens.com/productcert/pdf/ssa-166360.pdf(Third Party Advisory)
https://cert-portal.siemens.com/productcert/pdf/ssa-406175.pdf(Third Party Advisory)
https://cert-portal.siemens.com/productcert/pdf/ssa-433987.pdf(Third Party Advisory)
https://cert-portal.siemens.com/productcert/pdf/ssa-616199.pdf(Third Party Advisory)
https://cert-portal.siemens.com/productcert/pdf/ssa-832947.pdf(Third Party Advisory)
https://cert-portal.siemens.com/productcert/pdf/ssa-932041.pdf(Third Party Advisory)
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708(Patch, Vendor Advisory)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0708(US Government Resource)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain