Microsoft warns of major WannaCry-like Windows security exploit, releases XP patches

By Tom Warren@tomwarren May 14, 2019, 2:41pm EDT

Windows 10 and Windows 8 are safe

Microsoft is warning users of older versions of Windows to urgently apply a Windows Update today to protect against a potential widespread attack. The software giant has patched a critical remote code execution vulnerability in Remote Desktop Services that exists in Windows XP, Windows 7, and server versions like Windows Server 2003, Windows Server 2008 R2, and Windows Server 2008. Microsoft is taking the highly unusual approach of releasing patches for Windows XP and Windows Server 2003 even though both operating systems are out of support. Windows XP users will have to manually download the update from Microsoft’s update catalog.

“This vulnerability is pre-authentication and requires no user interaction,” explains Simon Pope, director of incident response at Microsoft’s Security Response Center. “In other words, the vulnerability is ‘wormable’, meaning that any future malware that exploits this vulnerability could propagate from vulnerable computer to vulnerable computer in a similar way as the WannaCry malware spread across the globe in 2017.”

•••••