Join our Newsletter — 33% off our NHI Course

How do you patch or mitigate CVE-2019-0708 (Microsoft Remote Desktop Services Remote Code Execution)?

CISA’s required action for CVE-2019-0708 is to apply updates per vendor instructions. In practice, find every instance of Microsoft Remote Desktop Services in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service. After patching, review logs for signs of earlier exploitation, because attackers used this flaw in the wild.

Patch CVE-2019-0708 by treating it as an internet-exposed remote execution emergency, not a routine desktop update. Find every Microsoft Remote Desktop Services instance, apply the vendor security update or the documented mitigation, and if you cannot remediate quickly, remove external exposure or take the service out of production. The highest-risk condition is any reachable RDP endpoint that remains unpatched while you are still determining exposure.

When a fix is not immediately possible, mitigation must change the attack surface, not just buy time. Disable or restrict direct internet access, place RDP behind a controlled remote access path, and confirm whether the affected systems are still needed at all. Remote Desktop (RDP) Security Guide and Network Ports and Protocols Security Guide both reinforce that exposed RDP is the core exposure to eliminate first.

After remediation, check for signs that the flaw was used before you patched. Because this CVE was actively exploited, you should review authentication, process creation, and remote access logs for anomalous sessions, lateral movement, or follow-on payloads. A clean patch does not prove a clean host if exploitation happened before the update landed.

Risk and Threat Considerations

The main risk is full remote code execution on a service that is often exposed for convenience. Once attackers can reach the vulnerable RDP service, they may use it as an initial foothold, then move laterally or stage follow-on activity before defenders notice.

Failure mechanism: Publicly reachable Remote Desktop Services instances can be probed and exploited before patching is complete, especially where exposure is broad and asset inventory is incomplete.

Impact: A successful exploit can lead to system compromise, credential theft, lateral movement, and broader environment access if the host has trusted network reach or administrative context.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework Control / Reference Relevance
NIST CSF 2.0 PR.PS-01 — Platform Security Remote Desktop patching and exposure reduction protect the platform hosting the vulnerable service.
Recommendation — Harden and update exposed RDP hosts before restoring normal access.
CIS Controls v8 CIS-7 — Continuous Vulnerability Management The issue is an actively exploited vulnerability requiring rapid asset discovery, remediation and verification.
Recommendation — Identify all affected systems and remediate the vulnerability on an emergency basis.
NIST SP 800-53 Rev 5 SI-2 — Flaw Remediation The response centers on applying vendor updates or mitigations for a known exploited flaw.
Recommendation — Apply the vendor fix or approved mitigation and verify completion across the estate.
MITRE ATT&CK T1210 — Exploitation of Remote Services CVE-2019-0708 is exploited through a remote service exposure path.
Recommendation — Hunt for exploitation of remote services and block exposed RDP attack paths.

Practitioner Guidance

What to prioritise: Start with internet-facing or externally reachable RDP endpoints, then move inward to internal systems that still permit high-trust remote administration. CISA Known Exploited Vulnerabilities Catalog is the right prioritisation lens when you need to justify emergency handling over normal patch queues.

What to verify: Confirm that the vendor update or mitigation was actually applied to every instance, not just the most visible servers. If you used exposure reduction instead of patching, verify that the service is no longer directly reachable from the internet and that the compensating control is enforced consistently.

Evidence to retain: Keep remediation timestamps, host inventory, and log-review findings together so you can show when exposure was removed, which systems were covered, and whether any suspicious activity was found before or after the fix. That evidence matters if later compromise review becomes necessary.

Practitioner takeaway: For actively exploited RDP flaws, the real decision is whether you can remove the attack path quickly enough, because patching without exposure control still leaves a window for exploitation.