Two weeks ago, Microsoft warned about a serious bug in old Windows systems that could lead to a malware outbreak. But even though a patch has been provided, close to a million machines appear to remain vulnerable to the threat.

The estimate comes from security researcher Robert Graham, head of Errata Security, who built a software tool to scan the internet for affected Windows machines. "I find nearly one-million devices on the public Internet that are vulnerable to the bug. That means when the [computer] worm hits, it'll likely compromise those million devices," he wrote in a Tuesday blog post.

The flaw is found in Windows 7, Windows XP, and Windows Server 2003 and 2008 systems, and pertains to the Remote Desktop Services feature. As the name suggests, the feature can let you remotely control a Windows machine over the internet.

Enterprises like to turn it on as a way to offer support and manage large fleets of computers. Unfortunately, the same feature suffers from a "pre-authentication" bug that doesn't always require password access to exploit. "In other words, the vulnerability is 'wormable,' meaning that any future malware that exploits this vulnerability could propagate from vulnerable computer to vulnerable computer," Microsoft warned in its security notice earlier this month.

To prevent a potential outbreak, Microsoft has issued patches for all the affected operating systems. According to Graham's estimate, about 1.4 million Windows machines show evidence of installing the fix. However, his scans also indicate that about 950,000 machines remain completely vulnerable to the threat.

Graham has made his tool available so system administrations can scan their networks for affected Windows machines. "You may have only one old WinXP machine that's vulnerable, that you don't care if it gets infected with ransomware," he wrote. "But that machine may have a Domain Admin logged in, so that when the worm breaks in, it [can] grab those credentials."

The good news is that Windows 10 and Windows 8 systems are protected from the flaw, and the vulnerability only works on machines with Remote Desktop Service turned on. So consumers are probably less affected.

Download patches for Windows 7 and Windows 2008 here and Windows 2003 and Windows XP here.