Cyber Resilience

CVE-2019-1181

Microsoft Windows 10 1607 … 1903

High EPSS
Published
14 August 2019
Modified
20 February 2026
Patch / advisory
View advisory
CVSS Score v3.1 9.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.75 99.4th percentile
Risk Priority 97 floored blend · peak EPSS

Summary

CVE-2019-1181 is a critical-severity an unspecified weakness vulnerability in Microsoft Windows 10. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 0.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests. This vulnerability is pre-authentication and requires no…

more

user interaction. An attacker who successfully exploited this vulnerability could execute arbitrary code on the target system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would need to send a specially crafted request to the target systems Remote Desktop Service via RDP. The update addresses the vulnerability by correcting how Remote Desktop Services handles connection requests.

CWE(s)
NVD-CWE-noinfo

Related Threats

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
Unauthenticated remote code execution via specially crafted RDP requests directly matches exploitation of a public-facing remote service.
attack.mitre.org →
T1021.001 Remote Desktop Protocol Lateral Movementconfidence: HIGH
The vulnerability is triggered by connecting to the target over RDP, enabling remote services access for code execution.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalationconfidence: HIGH
Successful exploitation grants arbitrary code execution, which inherently enables privilege escalation on the target system.
attack.mitre.org →
inferred from description · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2019-0618Same product: Microsoft Windows 10
CVE-2019-0626Same product: Microsoft Windows 10
CVE-2020-1300Same product: Microsoft Windows 10
CVE-2021-26424Same product: Microsoft Windows 10
CVE-2017-11771Same product: Microsoft Windows 10
CVE-2022-34721Same product: Microsoft Windows 10
CVE-2023-21760Same product: Microsoft Windows 10
CVE-2023-21765Same product: Microsoft Windows 10
CVE-2023-21746Same product: Microsoft Windows 10
CVE-2022-26809Same product: Microsoft Windows 10

Affected Assets

microsoft
windows 10
1607, 1703, 1709, 1803, 1809
microsoft
windows 7
all versions
microsoft
windows 8.1
all versions
microsoft
windows rt 8.1
all versions
microsoft
windows server 2008
all versions
microsoft
windows server 2012
all versions, r2
microsoft
windows server 2016
1803, 1903, all versions
microsoft
windows server 2019
all versions

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References