Microsoft implores Windows users to install patch for wormable BlueKeep Remote Code Execution vulnerability

Two weeks after warning about a critical Remote Code Execution vulnerability in Remote Desktop Services, Microsoft is concerned that around a million internet-connected computers remain unpatched and vulnerable to attack.

The company says that there is a risk that CVE-2019-0708, or BlueKeep, could turn into the next WannaCry if steps aren't taken to secure systems. While there is not yet any sign of a worm that exploits the vulnerability, proofs of concept do exist, and it could only be a matter of time before this changes. Microsoft is taking the matter so seriously, that it even released security patches for the unsupported Windows XP, Vista and 2003 -- people just need to install them.

See also:

• Most Windows 10 users are running the update from over a year ago
• Windows 10 May 2019 Update causes Wi-Fi dropouts for some users
• Exploit developer SandboxEscaper reveals Windows 10 Task Scheduler zero-day -- and says there are more to come

In a blog post, Simon Pope,  Director of Incident Response at Microsoft Security Response Center (MSRC), says that it is now two weeks since it released fixes for a critical Remote Code Execution vulnerability in Remote Desktop Services. He points to the WannaCry crisis of 2017 as an indication of what could happen if people do not take steps to secure their systems.

He writes:

Microsoft is confident that an exploit exists for this vulnerability, and if recent reports are accurate, nearly one million computers connected directly to the internet are still vulnerable to CVE-2019-0708. Many more within corporate networks may also be vulnerable. It only takes one vulnerable computer connected to the internet to provide a potential gateway into these corporate networks, where advanced malware could spread, infecting computers across the enterprise. This scenario could be even worse for those who have not kept their internal systems updated with the latest fixes, as any future malware may also attempt further exploitation of vulnerabilities that have already been fixed.

It's been only two weeks since the fix was released and there has been no sign of a worm yet. This does not mean that we’re out of the woods.

If you are yet to install the patch on your computer, now is the time to do so. Microsoft has downloads available for Windows 7, Windows 2008 R2 and Windows 2008 and for Windows Vista, Windows 2003 and Windows XP.

Image credit: Bumble Dee / Shutterstock