Remote Desktop Services Remote Code Execution (BlueKeep)
Actively exploited in the wild. Patch or mitigate immediately — don't wait for a maintenance window.
An unauthenticated attacker, remotely over the network, with no user interaction, can fully compromise the system — steal data, tamper with it and take it offline.
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.
Inferred from the weakness type (CWE) and how the flaw is reached — the techniques an attacker would chain to exploit this. Real-world corroboration appears here as threat intel is folded in.
Corroborated threat activity referencing this CVE — with source and confidence, not inference.
Groups documented using the techniques observed against this CVE — a tradecraft association, not a confirmed attribution. Overlap count shown; click for the MITRE profile.
These techniques were analysed against this CVE's real-world exploitation — the matching entries in the ATT&CK chain above are marked “observed”.
Generated by Wavense from the CVE record — an immediate mitigation and the permanent fix.
Block RDP access from untrusted networks, particularly the internet, using firewall rules. Enable Network Level Authentication (NLA) on all RDP-enabled systems to require authentication before session establishment, though this does not fully protect against all pre-auth attacks. Isolate critical systems with RDP enabled into a secure network segment and monitor RDP traffic for anomalies.
Apply the vendor-provided security patches immediately to all affected Windows systems. Microsoft released updates for Windows 7, Windows Server 2008 R2, Windows Server 2008, and even out-of-support Windows XP and Windows Server 2003 to address this critical vulnerability. Ensure all RDP-enabled systems are updated to prevent exploitation and potential worm-like attacks.
An unauthenticated attacker can remotely execute arbitrary code on vulnerable systems without user interaction. This allows for full system compromise, including data exfiltration, complete control over the device, and the potential for wormable malware propagation across networks. The critical nature of this vulnerability means widespread and severe business disruption is possible.
Other CVEs affecting agile controller-campus firmware
A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'.
Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to take control of the affected system when Windows Search fails to handle objects in memory, aka "Windows Search Remote Code Execution Vulnerability".
HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."
The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a crafted RPC request that triggers the overflow during path canonicalization, as exploited in the wild by Gimmiv.A in October 2008, aka "Server Service Vulnerability."
A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest operating system, aka 'Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1032, CVE-2020-1036, CVE-2020-1041, CVE-2020-1042, CVE-2020-1043.
Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.