Microsoft’s monthly Patch Tuesday updates rolled out earlier this week, and you will need to ensure that you do the latest updates.
“This vulnerability is pre-authentication and requires no user interaction,” reads Microsoft’s description of the four vulnerabilities (CVE-2019-1181, CVE-2019-1182, CVE-2019-1222, and CVE-2019-122). “An attacker who successfully exploited this vulnerability could execute arbitrary code on the target system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.”
That sounds terrifying, but don’t panic: The Remote Desktop Services protocol is disabled by default, so most home users shouldn’t be vulnerable. Unlike Bluekeep, however, this latest RDS exploit affects Windows 10. However, businesses who use Remote Desktop should display caution and do the updates
Simply applying the new updates closes the security hole. Your PC might have already done so automatically, but you should double-check. To do that, click on the Start button, then head to Options > Update & Security > Windows Update and click the Check for Updates button.
Microsoft has had to issue updates to harden the feature against exploits several times in 2019, so there’s no reason to expose your PC to the potential risk if you don’t actively use it. Search for “remote access” and select the “Allow remote access to your computer” option that appears. In the system properties pop-up that follows, ensure that “Allow remote assistance connections to this computer” is unchecked, then click OK.