CVE-2017-0145: Microsoft Windows SMBv1 Server Remote Code Execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with known ransomware use, has a very high EPSS score, public exploits exist, and it enables remote code execution with full host compromise.

What it is

The SMBv1 server in multiple Microsoft Windows versions mishandles crafted packets, allowing remote code execution. It is one of the SMBv1 flaws exploited by the EternalBlue/DoublePulsar toolset and is listed in CISA's Known Exploited Vulnerabilities catalog with known ransomware campaign use. The record does not specify the exact memory-safety root cause (CWE is listed as insufficient information).

Impact

A remote attacker can execute arbitrary code on the target host, typically with SYSTEM privileges, leading to full host compromise. Because SMBv1 is widely used for file sharing, a single compromised host can be used to move laterally across a network.

Attack surface

Reachable over the network via SMB (TCP 445/139) by sending crafted packets to the SMBv1 server; the CVSS vector indicates network access with low privileges required and no user interaction. No authentication is implied by the description, though the CVSS vector lists PR:L.

Exploitation

CISA KEV lists it as actively exploited with known ransomware campaign use, and EPSS is 0.8985 (99.78th percentile). Multiple references are tagged Exploit, including public DoublePulsar and Exploit-DB entries.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2017-0145 as soon as possible.
• Disable SMBv1 on all Windows systems and, where possible, on affected Siemens and third-party products.
• Block inbound SMB (TCP 445/139) at network boundaries and segment networks to limit lateral movement.
• Monitor for and remove EternalBlue/DoublePulsar artifacts on hosts that may have been previously compromised.
• For legacy or embedded systems that cannot be patched, isolate them on restricted VLANs with strict access controls.

Detection

• Hunt for SMBv1 negotiation traffic and anomalous SMB packets on TCP 445/139 using network IDS signatures for EternalBlue/DoublePulsar.
• Monitor Windows event logs and EDR telemetry for unexpected SYSTEM-level process creation or service installation originating from SMB activity.
• Scan hosts and network devices for SMBv1 enabled and for known DoublePulsar implant indicators.
• Review firewall and NetFlow logs for internal SMB connections that deviate from normal file-sharing patterns.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.