Vulnerability record · CVE-2019-1181 · published 14 August 2019
CVE-2019-1181: Windows Remote Desktop Services pre-auth remote code execution
Microsoft · Windows 10
Remote Desktop Services on multiple Windows versions mishandles specially crafted RDP connection requests, allowing remote code execution before authentication. The flaw is wormable in nature because it needs no credentials or user interaction, so any internet-exposed RDP endpoint is a direct target. Microsoft addressed it in the August 2019 updates.
Description
A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests. This vulnerability is pre-authentication and requires no user interaction. An attacker who successfully exploited this vulnerability could execute arbitrary code on the target system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would need to send a specially crafted request to the target systems Remote Desktop Service via RDP. The update addresses the vulnerability by correcting how Remote Desktop Services handles connection requests.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with network, no-auth, no-interaction exploitation and very high EPSS make this a top-priority patch for any RDP-exposed Windows host.
What it is
Remote Desktop Services on multiple Windows versions mishandles specially crafted RDP connection requests, allowing remote code execution before authentication. The flaw is wormable in nature because it needs no credentials or user interaction, so any internet-exposed RDP endpoint is a direct target. Microsoft addressed it in the August 2019 updates.
Impact
An unauthenticated attacker can execute arbitrary code with system-level rights, enabling program installation, data modification or deletion, and creation of accounts with full user rights.
Attack surface
Reached over the network via RDP against the target's Remote Desktop Service; the CVSS vector shows no privileges and no user interaction required, so it is pre-authentication and fully remote.
Exploitation
Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is very high at roughly 0.76 (99.5th percentile), indicating strong predicted exploitation activity; references are patch and third-party advisories only, with no public exploit tag.
What to do
- Apply the Microsoft August 2019 security updates for all affected Windows versions immediately
- Disable or block RDP (TCP 3389) from untrusted networks and restrict exposure to internal management networks
- Require RDP access through a VPN or RD Gateway with MFA rather than direct internet exposure
- Enable Network Level Authentication where feasible, though it does not fully mitigate this pre-auth flaw
- Monitor vendor advisories for any updated guidance and re-verify patch levels on all RDP-enabled hosts
Detection
- Audit for unpatched RDP-exposed hosts by correlating patch level with listening TCP 3389 services
- Monitor RDP connection logs (Event IDs 4624, 4625, and TerminalServices operational logs) for anomalous pre-auth connection patterns
- Alert on unexpected child processes spawned by svchost.exe or TermService on RDP hosts
- Watch for unusual outbound connections or new account creation shortly after RDP session activity
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
8 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2019-1181 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2019-1181), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
