---
id: "CVE-2017-0148"
kind: "vulnerability"
aliases: ["CVE-2017-0148"]
title: "Microsoft SMBv1 server: Microsoft SMBv1 Server Remote Code Execution Vulnerability"
severity: "critical"
cvss: 9.3
epss: 0.99356
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Microsoft SMBv1 server", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "file-servers", "infrastructure", "ransomware", "smb", "windows"]
not_affected_if: ["patched-systems", "smbv1-disabled"]
published_at: "2017-03-17T00:59:04+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-0148", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-0148", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-0148", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Microsoft SMBv1 server: Microsoft SMBv1 Server Remote Code Execution Vulnerability

The SMBv1 server in Microsoft Windows lets remote attackers run arbitrary code by sending crafted packets. This is the flaw behind the EternalBlue exploit family, and CISA lists it as known exploited, with ransomware use noted in the sources.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft SMBv1 server affected ? fixed ?

## Fix

Apply the Microsoft updates for CVE-2017-0148 per vendor instructions, as CISA requires. Disable SMBv1 if it is not needed; the exact command is unknown from the sources.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-0148
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2017-0148
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2017-0148

## From the sources

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, and CVE-2017-0146.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_