CVE-2019-07089.8Critical
Microsoft Remote Desktop Services Remote Code Execution Vulnerability
Microsoft · Remote Desktop Services
Exploited in the wild · in CISA KEV since 3 Nov 2021Known ransomware useExploitation attributed to NightEagle (per Kaspersky, Securelist)
99.9%probability of exploitation in the next 30 days
99th percentile
050100
Higher than 99% of scored CVEs
9.8CriticalCVSS
LowMediumHighCrit.
Federal deadline
CISA KEV · added 3 Nov · catalogue entry
Passed 1641 days ago
DescriptionNVD
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.
CISA required action
Apply updates per vendor instructions.
Coverage2 articles · 2 outlets
One row per outlet, in order of first report. First in our coverage: Securelist, 16 Sep.
Quiet for 6 weekslast report 21 Sep2 articles2 outlets
- Wed 16 Sep, 10:11 UTC. Securelist, first report. NightEagle Hackers Hide Exchange Backdoor Behind Stolen VPN Access. Cites a CVE in CISA KEV.
- Mon 21 Sep, 09:13 UTC. SecurityOnline, its first report on the story. NightEagle Hackers Target Russian Firms With GhostContainer Backdoor. Cites a CVE in CISA KEV.
- First report
- Article
- Running total
Show as tableHide table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| 16 Sep 10:11 | Securelist | NightEagle Hackers Hide Exchange Backdoor Behind Stolen VPN Access |
| 21 Sep 09:13 | SecurityOnline | NightEagle Hackers Target Russian Firms With GhostContainer Backdoor |
- NightEagle Hackers Target Russian Firms With GhostContainer BackdoorSecurityOnline · mentions it in passing
- NightEagle Hackers Hide Exchange Backdoor Behind Stolen VPN AccessSecurelist · first in our coverage
New articles also arrive in the RSS feed.