---
id: "CVE-2017-0144"
kind: "vulnerability"
aliases: ["CVE-2017-0144"]
title: "Microsoft SMBv1: Microsoft SMBv1 Remote Code Execution Vulnerability"
severity: "critical"
cvss: 9.3
epss: 0.9923
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Microsoft SMBv1", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "file-servers", "infrastructure", "ransomware", "smbv1", "windows"]
not_affected_if: ["patched-windows", "smbv1-disabled"]
published_at: "2017-03-17T00:59:04+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-0144", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-0144", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-0144", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Microsoft SMBv1: Microsoft SMBv1 Remote Code Execution Vulnerability

The SMBv1 server in multiple Windows versions lets remote attackers run arbitrary code by sending crafted packets. This is the EternalBlue flaw, actively exploited and used in ransomware campaigns.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft SMBv1 affected ? fixed ?

## Fix

Apply the Microsoft update for MS17-010 per vendor instructions; the sources do not name the KB numbers.
Disable SMBv1 if no legacy system still needs it; the sources do not give the exact command.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-0144
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2017-0144
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2017-0144

## From the sources

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_