{"id":"CVE-2017-0143","kind":"vulnerability","aliases":["CVE-2017-0143"],"related":[],"title":"Microsoft Windows: Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability","description":"The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.","summary":"Microsoft Windows SMBv1 (Server Message Block 1.0) has a remote code execution flaw, tracked as CVE-2017-0143 and known as the EternalBlue exploit path. An unauthenticated attacker who can reach the SMB port can run code on the Windows machine.","severity":"critical","cvss":9.3,"epss":0.93307,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Microsoft Windows","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","ransomware","self-hosted","smbv1","windows"],"not_affected_if":["no-windows-hosts","smbv1-disabled"],"how_to_check":null,"fix":"Apply the Microsoft security update for CVE-2017-0143 per vendor instructions (CISA required action).","status":"open","published_at":"2017-03-17T00:59:03+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:39:43+00:00","updated_at":"2026-10-23T21:57:34+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T21:39:43Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft security update for CVE-2017-0143 per vendor instructions (CISA required action).\nunknown","reach":"network","impact":"high","summary":"Microsoft Windows SMBv1 (Server Message Block 1.0) has a remote code execution flaw, tracked as CVE-2017-0143 and known as the EternalBlue exploit path. An unauthenticated attacker who can reach the SMB port can run code on the Windows machine.","category":"infrastructure","who_cares":["windows","smbv1","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs arbitrary code on the Windows host remotely","analyst_note":"Sources give no affected or fixed versions and no check command; confirm patch KB IDs and SMBv1 disable steps from the Microsoft advisory for CVE-2017-0143.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["smbv1-disabled","no-windows-hosts"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00048,"input_tokens":2844,"output_tokens":392,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Sources give no affected or fixed versions and no check command; confirm patch KB IDs and SMBv1 disable steps from the Microsoft advisory for CVE-2017-0143.","search":"'-0143':15A,18A,46B '-0144':137C '-0145':140C '-0146':143C '-0148':147C '-2017':14A,17A,45B,136C,139C,142C,146C '1.0':35B '10':101C '1511':103C '1607':105C '2008':80C '2012':92C '2016':109C '7':86C '8.1':89C,98C 'aka':120C 'allow':110C 'arbitrari':115C 'attack':56B,112C 'block':7A,34B 'code':10A,39B,65B,116C,124C 'craft':118C 'cve':13A,16A,44B,135C,138C,141C,145C 'describ':133C 'differ':130C 'eternalblu':51B 'execut':11A,40B,114C,125C 'exploit':21B,52B 'flaw':41B 'gold':93C,102C 'host':26B 'infrastructur':22B 'known':48B 'machin':69B 'messag':6A,33B 'microsoft':1A,3A,19A,29B,74C 'packet':119C 'path':53B 'port':62B 'r2':83C,95C 'ransomwar':23B 'reach':59B 'remot':9A,38B,111C,123C 'rt':97C 'run':64B 'self':25B 'self-host':24B 'server':5A,32B,72C,79C,91C,108C 'smb':61B,122C 'smbv1':8A,27B,31B,71C 'sp1':84C,87C 'sp2':77C,81C 'track':42B 'unauthent':55B 'via':117C 'vista':76C 'vulner':12A,126C,128C 'window':2A,4A,28B,30B,68B,75C,78C,85C,88C,90C,96C,100C,107C,121C 'windows':20A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2017-03-17T00:59:03+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2017-0143","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-0143","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T16:39:50+00:00","note":null},{"source":"epss","external_id":"CVE-2017-0143","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-0143","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2017-0143","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-0143","severity":null,"published_at":"2017-03-17T00:59:03+00:00","modified_at":"2026-06-17T00:57:09+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T21:57:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}