[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Cybersecurity](/category/cybersecurity) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [Why Should I Be Worried About BlueKeep (CVE-2019-0708)](/blog/bluekeep-rdp-cve-2019-five-reasons-to-be-worried) Publish date November 19, 2024 {x} minute read # Why Should I Be Worried About BlueKeep (CVE-2019-0708) [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](#) [Free trial](/demo) Written by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents Free resource ### [Download now](#) The BlueKeep RDP [vulnerability](/blog/vulnerability) ([CVE](/blog/cve)-2019-0708) is a remote code execution flaw that affects approximately one million systems (as at 29 May 2019) running older versions of Microsoft operating systems. Attention shifted to BlueKeep about two weeks ago, during Microsoft's May 2019 Patch Tuesday. [Microsoft released patches](https://portal.msrc.microsoft.com/en-us/security-guidance) but their warning that the vulnerability is [wormable](/blog/computer-worm) drew the attention of security researchers who have uncovered more concerning findings about this emerging [cyber threat](https://www.upguard.com/blog/cyber-threat). ## Five Reasons To Worry About BlueKeep ### 1. BlueKeep is a "wormable" flaw That means it's similar to the EternalBlue [exploit](/blog/exploit) that was used in [ransomware](/blog/ransomware) attacks such as [WannaCry](/blog/wannacry) and NotPetya. Wormable attacks are especially dangerous as they can spread automatically on unprotected systems. ### 2. BlueKeep primarily affects older, more vulnerable systems Vulnerabilities that affect older systems are a double whammy for [cybersecurity risk](/blog/cybersecurity-risk). Systems running on old operating systems are typically not well maintained by the vendor (in this case, Microsoft), or by the end user, because they're usually running legacy applications. For example Windows XP is affected, which is out of support. It is of serious concern that Microsoft felt that BlueKeep was significant enough to warrant the first Patch Tuesday release for XP in five years. ### 3. The nature of the vulnerability lends itself to dangerous attacks The risk of a remote code execution vulnerability in Remote Desktop Services (RDS) is that it can be exploited by attackers, by connecting to the targeted system via the RDP (Remote Desktop Protocol) and running arbitrary code on the system. Given that RDS/RDP is involved, a proportion of the \~1 million exposed targets are likely to be high value targets such as jump boxes which are an entry point into a more valuable network. ### 4. Imminent threats have been detected Reports are in that a number of threat actors are executing port scans to detect the BlueKeep vulnerability on Windows systems. These actors have been detected hiding behind dozens of [TOR exit nodes](/blog/dark-web-vs-deep-web#darkweb), indicating that the a wave of BlueKeep-related [cyber attacks](https://www.upguard.com/blog/cyber-attack) could be next. Thankfully, security researchers have not yet published any proof-of-concept exploit code for BlueKeep. However, several companies have publicly disclosed that they've successfully developed exploit code for BlueKeep, which they intend to keep private. The list includes [McAfee](https://twitter.com/ChristiaanBeek/status/1129617415707533312), [Kaspersky](https://twitter.com/oct0xor/status/1130534732863803400), [Check Point](https://twitter.com/eyalitkin/status/1130890202229157888) and [MalwareTech](https://twitter.com/MalwareTechBlog/status/1131784918810353665). ### 5. Vulnerable systems are easily discoverable It's never been easier to find exposed hosts. Tools such as Masscan and Zmap can be used to scan the entire Internet in minutes, making it trivial for attackers to find vulnerable systems. The author of Masscan, Robert Graham of Errata Security has already published an [open source scanner for BlueKeep on GitHub](https://github.com/robertdavidgraham/rdpscan).   ## Which Systems are Vulnerable to BlueKeep? The BlueKeep vulnerability affects older versions of Microsoft Windows, including: * Windows XP * Windows Vista * Windows 7 * Windows Server 2003 * Windows Server 2008 * Windows Server 2008 R2 Newer versions of Windows, such as Windows 10 and Windows 8 are considered safe at this stage. ## How to Mitigate the Risks Posed by BlueKeep Organizations that use [UpGuard](/product/breachsight) are able to instantly pinpoint any vulnerable machines on their network, and help answer key questions that de-risk this emerging threat: * Are my organization's Internet-facing and internal machines exposing port 3389? Are my [third-party vendors](/blog/third-party-vendor) exposed? * Is RDP running on those ports? * Which vulnerable machines are running legacy editions of Windows, and are they patched? UpGuard have already published a policy for our customers to detect this. * Does the machine have NLA (Network Level Authentication) enabled? These machines could still be exploitable by an attacker who has valid credentials. However, they are less vulnerable to anonymous worm-based attacks.  **If your organization is looking for help with the BlueKeep RDP vulnerability, UpGuard can pinpoint and manage this threat before an attack.** Free resource ### [Download now](#) ## Related posts Learn more about the latest issues in cybersecurity. Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization) Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us. [](/team/revashni-moodley) [Revashni Moodley](#) August 25, 2026 Cybersecurity #### [Surviving a LockBit Ransomware Attack: The ROI of Visibility](/blog/surviving-a-lockbit-ransomware-attack) Read how veteran CISO Nick Gicinto saved his alma mater from a LockBit ransomware attack by discarding the standard playbook. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) June 1, 2026 Cybersecurity #### [Top 10 Security Events of 2025](/blog/top-security-events-of-2025) Recap the ten most impactful events that reshaped the cybersecurity industry this year and the critical lessons each had to teach us. Read more here. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Risk Automations: The Shift From Catch-Up to Command](/blog/risk-automations-shift-catch-up-to-command) Connect intelligence to system execution with Risk Automations, your new resolution layer for risk. Reduce remediation from hours to seconds - read more. [](/team/revashni-moodley) [Revashni Moodley](#) December 1, 2025 Cybersecurity #### [Shai-Hulud's True Lesson for CISOs: A Crisis of Communication](/blog/shai-hulud-lesson-for-cisos) Shai-Hulud was driven by a communication crisis between security and engineering. Get a CISO's perspective on how to finally bridge this gap. [](/team/phil-ross) [Phil Ross](#) September 3, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)