CVE-2019-0887

What it actually does

Authenticated attacker with RDP access can abuse clipboard redirection to trigger remote code execution on the target system.

Why it matters to the business

Compromised remote desktop sessions can lead to full system takeover, data theft, or lateral movement across Windows environments that rely on RDP for administration or user access.

How an attack unfolds

An attacker with valid credentials connects to a vulnerable Remote Desktop Services host, enables or manipulates clipboard redirection, and crafts malicious clipboard data that triggers the path traversal flaw to execute arbitrary code without further user interaction.

How to fix it

Apply the latest cumulative Windows security updates that address this issue for all affected versions of Windows and Remote Desktop Services; if patching is delayed, disable clipboard redirection via Group Policy or RDP connection settings.

How to confirm the fix worked

Verify that current Windows security updates are installed on all systems exposing Remote Desktop Services; test RDP connections with clipboard redirection disabled to confirm the attack surface is reduced; review update history for KB articles addressing CVE-2019-0887.

Typical attack path

1. Obtain valid domain or local credentials for an RDP-accessible account
2. Establish an RDP session with clipboard redirection enabled
3. Inject specially crafted data through the clipboard channel
4. Trigger the flaw to achieve code execution on the target host
5. Establish persistence or move laterally from the compromised system

How to detect it

Review Windows Event Logs for TerminalServices-RemoteConnectionManager and TerminalServices-LocalSessionManager events around RDP session establishment; look for unusual clipboard-related activity or processes spawned immediately after RDP logons; correlate with authentication logs from domain controllers.

What your security team should do

• Prioritize deployment of applicable Windows security updates across all affected hosts
• Restrict RDP access to only necessary users and hosts using network controls and MFA
• Disable clipboard redirection by default unless explicitly required for business operations
• Monitor for new exploit code or public proof-of-concepts given the high EPSS score