The remote Windows host is missing security update 4499180 or cumulative update 4499149. It is, therefore, affected by multiple vulnerabilities :

  - A denial of service vulnerability exists when .NET     Framework and .NET Core improperly process RegEx     strings. An attacker who successfully exploited this     vulnerability could cause a denial of service against a     .NET application. A remote unauthenticated attacker     could exploit this vulnerability by issuing specially     crafted requests to a .NET Framework (or .NET core)     application. The update addresses the vulnerability by     correcting how .NET Framework and .NET Core applications     handle RegEx string processing. (CVE-2019-0820)

  - A remote code execution vulnerability exists when     Microsoft Windows OLE fails to properly validate user     input. An attacker could exploit the vulnerability to     execute malicious code.  (CVE-2019-0885)

  - An elevation of privilege vulnerability exists when the     Windows Kernel improperly handles key enumeration. An     attacker who successfully exploited the vulnerability     could gain elevated privileges on a targeted system. A     locally authenticated attacker could exploit this     vulnerability by running a specially crafted     application. The security update addresses the     vulnerability by helping to ensure that the Windows     Kernel properly handles key enumeration. (CVE-2019-0881)

  - An elevation of privilege vulnerability exists in     Microsoft Windows when Windows fails to properly handle     certain symbolic links. An attacker who successfully     exploited this vulnerability could potentially set     certain items to run at a higher level and thereby     elevate permissions.  (CVE-2019-0936)

  - An spoofing vulnerability exists when Internet Explorer     improperly handles URLs. An attacker who successfully     exploited this vulnerability could trick a user by     redirecting the user to a specially crafted website. The     specially crafted website could either spoof content or     serve as a pivot to chain an attack with other     vulnerabilities in web services.  (CVE-2019-0921)

  - A remote code execution vulnerability exists when the     Windows Jet Database Engine improperly handles objects     in memory. An attacker who successfully exploited this     vulnerability could execute arbitrary code on a victim     system. An attacker could exploit this vulnerability by     enticing a victim to open a specially crafted file. The     update addresses the vulnerability by correcting the way     the Windows Jet Database Engine handles objects in     memory. (CVE-2019-0889, CVE-2019-0890, CVE-2019-0891,     CVE-2019-0893, CVE-2019-0894, CVE-2019-0895,     CVE-2019-0896, CVE-2019-0897, CVE-2019-0898,     CVE-2019-0899, CVE-2019-0900, CVE-2019-0901,     CVE-2019-0902)

  - A denial of service vulnerability exists when .NET     Framework improperly handles objects in heap memory. An     attacker who successfully exploited this vulnerability     could cause a denial of service against a .NET     application.  (CVE-2019-0864)

  - A remote code execution vulnerability exists in Remote     Desktop Services formerly known as Terminal Services     when an unauthenticated attacker connects to the target     system using RDP and sends specially crafted requests.
    This vulnerability is pre-authentication and requires no     user interaction. An attacker who successfully exploited     this vulnerability could execute arbitrary code on the     target system. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights.  (CVE-2019-0708)

  - An information disclosure vulnerability exists when the     Windows GDI component improperly discloses the contents     of its memory. An attacker who successfully exploited     the vulnerability could obtain information to further     compromise the users system. There are multiple ways an     attacker could exploit the vulnerability, such as by     convincing a user to open a specially crafted document,     or by convincing a user to visit an untrusted webpage.
    The security update addresses the vulnerability by     correcting how the Windows GDI component handles objects     in memory. (CVE-2019-0758, CVE-2019-0882, CVE-2019-0961)

  - An information disclosure vulnerability exists when     Internet Explorer improperly handles objects in memory.
    An attacker who successfully exploited the vulnerability     could obtain information to further compromise the users     system.  (CVE-2019-0930)

  - An elevation of privilege vulnerability exists in     Microsoft Windows when a man-in-the-middle attacker is     able to successfully decode and replace authentication     request using Kerberos, allowing an attacker to be     validated as an Administrator. The update addresses this     vulnerability by changing how these requests are     validated. (CVE-2019-0734)

  - A denial of service vulnerability exists when .NET     Framework or .NET Core improperly handle web requests.
    An attacker who successfully exploited this     vulnerability could cause a denial of service against a     .NET Framework or .NET Core web application. The     vulnerability can be exploited remotely, without     authentication. A remote unauthenticated attacker could     exploit this vulnerability by issuing specially crafted     requests to the .NET Framework or .NET Core application.
    The update addresses the vulnerability by correcting how     .NET Framework or .NET Core web applications handles web     requests. (CVE-2019-0980, CVE-2019-0981)

  - A remote code execution vulnerability exists in the way     that the Windows Graphics Device Interface (GDI) handles     objects in the memory. An attacker who successfully     exploited this vulnerability could take control of the     affected system. An attacker could then install     programs; view, change, or delete data; or create new     accounts with full user rights.  (CVE-2019-0903)

  - A remote code execution vulnerability exists in the way     the scripting engine handles objects in memory in     Microsoft browsers. The vulnerability could corrupt     memory in such a way that an attacker could execute     arbitrary code in the context of the current user. An     attacker who successfully exploited the vulnerability     could gain the same user rights as the current user.
    (CVE-2019-0884, CVE-2019-0918)

Detections

Analytics

KB4499180: Windows Server 2008 and Windows Vista SP2 May 2019 Security Update (BlueKeep)

critical Nessus Plugin ID 125060

Version 1.18

Version 1.17

Version 1.16

Version 1.15

Version 1.18 Jul 19, 2025, 11:55 PM CISA reference Plugin Feed: 202507192355
Version 1.17 Jul 19, 2025, 5:32 AM CISA reference Plugin Feed: 202507190532
Version 1.16 Jun 17, 2024, 3:35 PM Plugin metadata (add more granular CPEs to Windows OS plugins) Plugin Feed: 202406171535
Version 1.15 Dec 6, 2022, 6:53 AM Reference Plugin Feed: 202212060653