CVE-2019-0703: Windows SMB Server information disclosure flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw is confirmed exploited in the wild per CISA KEV and affects a broad set of Windows and Windows Server versions, though it is limited to information disclosure with low privileges required.

What it is

CVE-2019-0703 is an information disclosure vulnerability in the way the Windows SMB Server handles certain requests. A network attacker with low privileges can cause the server to leak information; the record does not specify what data is exposed or the exact request handling defect.

Impact

An attacker gains unauthorized read access to information held or processed by the SMB server, with high confidentiality impact but no integrity or availability effect. The specific leaked data is not described in the record.

Attack surface

Reached over the network via SMB (CVSS vector AV:N) with low privileges required (PR:L) and no user interaction (UI:N). No authentication-free path is indicated; the attacker needs at least a low-privileged account or session.

Exploitation

CVE-2019-0703 is listed in CISA KEV (added 2022-05-23), indicating known exploitation in the wild, and EPSS gives a 30-day probability of about 9.6 percent (95th percentile). No ransomware campaign use is recorded.

What to do

• Apply the Microsoft security update referenced in the vendor advisory for all affected Windows and Windows Server versions.
• Restrict SMB exposure: block TCP 445 and 139 at network boundaries and segment SMB traffic to trusted hosts only.
• Enforce least privilege so low-privileged accounts cannot reach SMB services unnecessarily.
• Monitor vendor advisories for superseding updates and verify patch status across the listed Windows 7, 8.1, 10 and Server builds.

Detection

• Review SMB server logs and network flow data for anomalous or malformed request patterns against hosts running unpatched Windows versions.
• Alert on SMB connections from low-privileged or unusual accounts to servers that should not receive them.
• Correlate host patch inventory against the affected Windows and Windows Server builds to find unpatched SMB servers.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.