← Vulnerability Intelligence

CVE-2017-0143

High 8.8 Exploited in the wild (KEV) Used in ransomware campaigns

Confirmed active exploitation — CISA KEV catalog

Name
Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability
Added to catalog
Remediation due date (US federal)
Required action
Apply updates per vendor instructions.

Description

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.

Metrics

CVSS 3.1
8.8 (HIGH) Score source: NVD CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS — exploit probability
93% (percentile: 100) as of 1 November 2026

Affected products

microsoft: server message block; microsoft: windows 10 1507; microsoft: windows 10 1511; microsoft: windows 10 1607; microsoft: windows 7; microsoft: windows 8.1; microsoft: windows rt 8.1; microsoft: windows server 2008; microsoft: windows server 2012; microsoft: windows server 2016; microsoft: windows vista; philips: intellispace portal; siemens: acuson p300 firmware; siemens: acuson p300; siemens: acuson p500 firmware

References