CVE-2017-0144: Microsoft Windows SMBv1 server remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with confirmed ransomware use, has near-maximum EPSS probability, public exploits, and grants remote code execution on unpatched SMBv1 hosts.

What it is

The SMBv1 server in multiple Microsoft Windows versions mishandles crafted packets, allowing remote code execution. The flaw is remotely reachable over the network and is the vulnerability exploited by the EternalBlue tooling, making it a high-value target for wormable and ransomware activity.

Impact

An attacker can execute arbitrary code on the target host with the privileges of the SMB service, leading to full system compromise. This enables lateral movement, credential theft and ransomware deployment across exposed networks.

Attack surface

Reached over the network via SMBv1 (TCP 445/139) by sending crafted packets; the CVSS vector indicates network access with low attack complexity and low privileges required, and no user interaction. Any host still running SMBv1 and reachable on the network is exposed.

Exploitation

Listed in CISA KEV since 2022-02-10 with known ransomware campaign use, and EPSS 30-day probability is 0.9923 (99.9th percentile); multiple public exploit references exist, so exploitation is widespread and mature.

What to do

• Apply the Microsoft security update for CVE-2017-0144 (MS17-010) on all affected Windows systems.
• Disable SMBv1 entirely where possible and block inbound SMB (TCP 445/139) at network boundaries.
• Apply vendor firmware updates for affected Siemens and Acuson/medical device products listed in the advisories.
• Segment legacy systems that cannot be patched and restrict SMB access to trusted hosts only.
• Monitor and remove any DOUBLEPULSAR backdoor implants found on patched or unpatched hosts.

Detection

• Hunt for SMBv1 negotiation traffic and anomalous SMB packets on TCP 445/139 across the estate.
• Alert on known EternalBlue/DOUBLEPULSAR exploit signatures and payload patterns in network IDS/IPS.
• Check hosts for DOUBLEPULSAR implant artifacts and unexpected SMB service crashes or restarts.
• Correlate SMB scanning activity followed by service creation or lateral SMB connections from the same source.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.