{"id":"CVE-2017-0146","kind":"vulnerability","aliases":["CVE-2017-0146"],"related":[],"title":"Microsoft Windows: Microsoft Windows SMB Remote Code Execution Vulnerability","description":"The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, and CVE-2017-0148.","summary":"Remote code execution in the Windows SMBv1 server (EternalBlue) via crafted packets. Fixed by MS17-010 (March 14, 2017). Actively exploited, including by ransomware. Unpatched Windows with SMBv1 reachable on the network is exposed.","severity":"critical","cvss":9.3,"epss":0.89755,"exploited":true,"exploited_at":"2022-03-25T00:00:00+00:00","products":[{"name":"Microsoft Windows","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Windows SMBv1 server","fixed":["KB4012598","KB4012212","KB4012215","KB4012213","KB4012216","KB4012214","KB4012217","KB4012606","KB4013198","KB4013429"],"affected":"Windows Vista SP2, Server 2008 SP2, Win7 SP1, Server 2008 R2 SP1, Win8.1, Server 2012, Server 2012 R2, RT 8.1, Win10 RTM/1511/1607, Server 2016 without MS17-010","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","ransomware","self-hosted","smb","windows"],"not_affected_if":["patched-ms17-010","patched-windows","smbv1-disabled","windows-10-1709-or-later-default","windows-server-2019-or-later"],"how_to_check":"On each Windows host run in PowerShell: Get-SmbServerConfiguration | Select EnableSMB1Protocol (True = SMBv1 server on). On Windows 7/Server 2008 R2 and older, check registry HKLM\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters for an SMB1 DWORD; if absent, SMBv1 is enabled by default. Then confirm the MS17-010 KB for your build is installed (Get-HotFix -Id KB4012212,KB4012215 etc.).","fix":"Install the MS17-010 update for your build: Vista SP2 / Server 2008 SP2: KB4012598; Win7 / Server 2008 R2: KB4012212 (security only) or KB4012215 (rollup); Win8.1 / Server 2012 R2 / RT 8.1: KB4012213 (security only) or KB4012216 (rollup); Server 2012: KB4012214 or KB4012217; Win10 RTM: KB4012606; Win10 1511: KB4013198; Win10 1607 / Server 2016: KB4013429. Also disable SMBv1 if not needed: Set-SmbServerConfiguration -EnableSMB1Protocol $false (or Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol), and block TCP 445 at the perimeter.","status":"open","published_at":"2017-03-17T00:59:04+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:21:50+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-10-23T21:21:50Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft security update for MS17-010 (CVE-2017-0146) per vendor instructions, and disable SMBv1 if it is not needed.","reach":"network","impact":"high","summary":"The SMBv1 server in Microsoft Windows lets a remote attacker send crafted packets and run code on the target machine. This is the EternalBlue flaw, and it is listed as actively exploited, including by ransomware.","category":"infrastructure","who_cares":["windows","smb","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Remote attacker runs code as SYSTEM on the Windows host over the network.","analyst_note":"Confirm the exact affected Windows builds and the patch KB list from the Microsoft MS17-010 bulletin, and add a check command for SMBv1 status; sources here do not give them.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["smbv1-disabled","patched-windows"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000472,"input_tokens":2819,"output_tokens":380,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the exact affected Windows builds and the patch KB list from the Microsoft MS17-010 bulletin, and add a check command for SMBv1 status; sources here do not give them.","search":"'-010':44B '-0143':130C '-0144':133C '-0145':136C '-0146':12A,15A '-0148':140C '-2017':11A,14A,129C,132C,135C,139C '10':94C '14':46B '1511':96C '1607':98C '2008':73C '2012':85C '2016':102C '2017':47B '7':79C '8.1':82C,91C 'activ':48B 'aka':113C 'allow':103C 'arbitrari':108C 'attack':105C 'code':7A,30B,109C,117C 'craft':39B,111C 'cve':10A,13A,128C,131C,134C,138C 'describ':126C 'differ':123C 'eternalblu':37B 'execut':8A,31B,107C,118C 'exploit':21B,49B 'expos':62B 'fix':41B 'gold':86C,95C 'host':26B 'includ':50B 'infrastructur':22B 'march':45B 'microsoft':1A,3A,16A,67C 'ms17':43B 'network':60B 'packet':40B,112C 'r2':76C,88C 'ransomwar':23B,52B 'reachabl':57B 'remot':6A,29B,104C,116C 'rt':90C 'self':25B 'self-host':24B 'server':20A,36B,65C,72C,84C,101C 'smb':5A,27B,115C 'smbv1':19A,35B,56B,64C 'sp1':77C,80C 'sp2':70C,74C 'unpatch':53B 'via':38B,110C 'vista':69C 'vulner':9A,119C,121C 'window':2A,4A,28B,34B,54B,68C,71C,78C,81C,83C,89C,93C,100C,114C 'windows':17A,18A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2017-03-17T00:59:04+00:00","kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2017-0146","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-0146","severity":null,"published_at":"2022-03-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T13:39:32+00:00","note":null},{"source":"epss","external_id":"CVE-2017-0146","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-0146","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2017-0146:75","url":null,"severity":null,"published_at":"2026-10-23T21:25:53+00:00","modified_at":"2026-10-23T21:25:53+00:00","first_seen_at":"2026-10-23T21:25:53+00:00","fetched_at":"2026-10-23T21:25:53+00:00","note":"Read MS17-010 bulletin (KB4013389) and Microsoft SMBv1 detect/disable page; builds and KBs from bulletin table (page text truncated after Server Core rows, so later rows not read). No PoC link or X check done; exploited status from KEV triage."},{"source":"nvd","external_id":"CVE-2017-0146","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-0146","severity":null,"published_at":"2017-03-17T00:59:04+00:00","modified_at":"2026-06-17T00:57:09+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[{"id":1004,"url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2017/ms17-010","title":"Microsoft Security Bulletin MS17-010","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1005,"url":"https://learn.microsoft.com/en-us/windows-server/storage/file-server/troubleshoot/detect-enable-and-disable-smbv1-v2-v3","title":"Detect, enable, and disable SMBv1, SMBv2, SMBv3 in Windows","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}