---
id: "CVE-2017-0146"
kind: "vulnerability"
aliases: ["CVE-2017-0146"]
title: "Microsoft Windows: Microsoft Windows SMB Remote Code Execution Vulnerability"
severity: "critical"
cvss: 9.3
epss: 0.89755
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Microsoft Windows", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Windows SMBv1 server", "fixed": ["KB4012598", "KB4012212", "KB4012215", "KB4012213", "KB4012216", "KB4012214", "KB4012217", "KB4012606", "KB4013198", "KB4013429"], "affected": "Windows Vista SP2, Server 2008 SP2, Win7 SP1, Server 2008 R2 SP1, Win8.1, Server 2012, Server 2012 R2, RT 8.1, Win10 RTM/1511/1607, Server 2016 without MS17-010", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "ransomware", "self-hosted", "smb", "windows"]
not_affected_if: ["patched-ms17-010", "patched-windows", "smbv1-disabled", "windows-10-1709-or-later-default", "windows-server-2019-or-later"]
published_at: "2017-03-17T00:59:04+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-0146", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-0146", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:25:53+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-0146", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Microsoft Windows: Microsoft Windows SMB Remote Code Execution Vulnerability

Remote code execution in the Windows SMBv1 server (EternalBlue) via crafted packets. Fixed by MS17-010 (March 14, 2017). Actively exploited, including by ransomware. Unpatched Windows with SMBv1 reachable on the network is exposed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Windows affected ? fixed ?
- vendor:Windows SMBv1 server affected Windows Vista SP2, Server 2008 SP2, Win7 SP1, Server 2008 R2 SP1, Win8.1, Server 2012, Server 2012 R2, RT 8.1, Win10 RTM/1511/1607, Server 2016 without MS17-010 fixed KB4012598, KB4012212, KB4012215, KB4012213, KB4012216, KB4012214, KB4012217, KB4012606, KB4013198, KB4013429

## How to check

On each Windows host run in PowerShell: Get-SmbServerConfiguration | Select EnableSMB1Protocol (True = SMBv1 server on). On Windows 7/Server 2008 R2 and older, check registry HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters for an SMB1 DWORD; if absent, SMBv1 is enabled by default. Then confirm the MS17-010 KB for your build is installed (Get-HotFix -Id KB4012212,KB4012215 etc.).

## Fix

Install the MS17-010 update for your build: Vista SP2 / Server 2008 SP2: KB4012598; Win7 / Server 2008 R2: KB4012212 (security only) or KB4012215 (rollup); Win8.1 / Server 2012 R2 / RT 8.1: KB4012213 (security only) or KB4012216 (rollup); Server 2012: KB4012214 or KB4012217; Win10 RTM: KB4012606; Win10 1511: KB4013198; Win10 1607 / Server 2016: KB4013429. Also disable SMBv1 if not needed: Set-SmbServerConfiguration -EnableSMB1Protocol $false (or Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol), and block TCP 445 at the perimeter.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-0146
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2017-0146
- 2026-10-23T21:25:53+00:00 analyst — Read MS17-010 bulletin (KB4013389) and Microsoft SMBv1 detect/disable page; builds and KBs from bulletin table (page text truncated after Server Core rows, so later rows not read). No PoC link or X check done; exploited status from KEV triage.
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2017-0146

## Documents

- [advisory] Microsoft Security Bulletin MS17-010 https://learn.microsoft.com/en-us/security-updates/securitybulletins/2017/ms17-010
- [mitigation] Detect, enable, and disable SMBv1, SMBv2, SMBv3 in Windows https://learn.microsoft.com/en-us/windows-server/storage/file-server/troubleshoot/detect-enable-and-disable-smbv1-v2-v3

## From the sources

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, and CVE-2017-0148.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_