CVE-2019-0703

CVE-2019-0703 is a medium-severity (CVSS 6.5) vulnerability in Microsoft Windows. CISA added it to the Known Exploited Vulnerabilities catalog on May 23, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by June 13, 2022. CISA does not currently list it as used in ransomware campaigns. Microsoft has 390 vulnerabilities in the KEV catalog, 117 of them linked to ransomware.

An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0704, CVE-2019-0821.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0703
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0703
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0703