CVE-2017-0146

SMBv1 is an older Windows file-sharing protocol. This vulnerability is a weakness in the SMBv1 server that can be triggered over the network by a malicious request. Think of it like a door in a warehouse that was meant to be locked, but a break-in method was later discovered and then used in real ransomware attacks.

This matters if you run or manage any Microsoft Windows systems with the SMBv1 server component enabled—listed Windows include Windows Vista Service Pack 2, Windows Server 2008 Service Pack 2 and R2 Service Pack 1, Windows 7 Service Pack 1, Windows 8, Windows 8.1, Windows Server 2012 (Gold and R2), Windows RT 8.1, and Windows 10 (Gold, 1511, 1607). It’s mainly a risk when attackers can reach SMBv1 over the network (commonly via TCP 445), such as from internal segments, VPN/remote access paths, or the internet.

This is RED because it is listed by CISA in its Known Exploited Vulnerabilities program and has been used in ransomware campaigns. Public exploits exist, meaning attackers can likely use this vulnerability without much effort once SMBv1 is reachable. Treat any machine with SMBv1 enabled and network-reachable as an active, high-priority risk.

1. Confirm scope (affected systems and exposure)

• Inventory your Windows devices: specifically check for Windows versions matching those called out for CVE-2017-0146.
• On each candidate machine, confirm whether SMBv1 server capability is enabled and reachable.
• Pay special attention to systems that are reachable from other networks you don’t fully trust (office-to-office routing, guest Wi‑Fi/VLANs, remote access entry points, and anything exposed to the internet).

2. Remediate

• Disable SMBv1 on affected Windows systems (this prevents the SMBv1 server from accepting the vulnerable protocol).
• Apply Microsoft’s recommended updates for CVE-2017-0146 using the vendor remediation guidance linked in the findings.

3. Verification (don’t stop after patching)

• Re-check that SMBv1 is disabled (so SMBv1 negotiation/usage is no longer possible).
• Verify the relevant security update for CVE-2017-0146 is installed on the system.
• Look for SMBv1-related traffic patterns: after changes, SMBv1-related network activity should drop.

4. If you cannot patch immediately

• The most direct mitigation is to disable SMBv1 (protocol-level shutdown), then plan for patch installation as soon as possible.
• Reduce network exposure of file-sharing services so that TCP 445 is not reachable from untrusted networks.

5. KEV timing note

• CISA KEV listed this CVE with a remediation due date of 2022-04-15; if you haven’t already acted, treat this as overdue.

6. What to monitor after remediation

• Attempts to use SMBv1 from internal/external sources (unexpected spikes).
• Any signs of compromise around the time SMBv1 was enabled (unusual logon activity, service creation, and file-system changes).

CVE-2017-0146 targets the SMBv1 server in multiple Microsoft Windows versions. The weakness enables a remote attacker to trigger a flaw by sending crafted SMBv1 traffic (network-based reachability over file-sharing). This CVE is present in CISA KEV, meaning it has been observed in real-world exploitation tied to ransomware campaigns; CISA required remediation by 2022-04-15. A public exploit is available (multiple known variants), which increases the practical risk of automated or opportunistic attacks. KEV (confirmed exploitation) overrides prediction; EPSS is provided as a prediction in the findings but should not be used as the basis for urgency given the confirmed KEV status. KEV here signals that defenders should assume active attacker interest when SMBv1 is reachable and enabled.