CVE-2017-0143: Microsoft Windows SMBv1 Server Remote Code Execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with known ransomware use, has a very high EPSS score, and public exploits exist, making it an urgent patching priority.

What it is

The SMBv1 server in multiple Microsoft Windows versions fails to properly handle crafted packets, allowing remote code execution. This is one of the vulnerabilities exploited by the EternalBlue/DOUBLEPULSAR toolset and has been used in widespread ransomware campaigns. It matters because SMBv1 is still enabled on many legacy and embedded systems, including medical and industrial products listed by Siemens and Philips.

Impact

An attacker can execute arbitrary code with the privileges of the SMB service, typically SYSTEM, leading to full host compromise. This enables lateral movement, data theft, and ransomware deployment across a network.

Attack surface

Reachable over the network via SMB (TCP 445 or 139) with no user interaction required. The CVSS vector indicates low privileges are needed (PR:L), though public exploits often work without authentication against vulnerable SMBv1 configurations.

Exploitation

Listed in CISA KEV since 2021-11-03 with known ransomware campaign use, and EPSS probability is 0.933 (99.8th percentile). Multiple public exploit references exist, including Exploit-DB and Packet Storm entries for DOUBLEPULSAR.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for all affected Windows versions.
• Disable SMBv1 on all systems and devices where it is not strictly required.
• Block inbound SMB (TCP 445/139) at network boundaries and segment legacy systems.
• Apply vendor firmware updates for affected Siemens and Philips products.
• Monitor for and remove DOUBLEPULSAR implants if compromise is suspected.

Detection

• Hunt for SMBv1 negotiation traffic and anomalous SMB packets on internal networks.
• Monitor for known DOUBLEPULSAR implant artifacts and backdoor SMB sessions.
• Alert on unexpected outbound SMB connections from servers and workstations.
• Review Windows event logs for SMB service crashes or unusual process creation from services.exe.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.