← Vulnerability Intelligence

CVE-2017-0147

High 7.5 Exploited in the wild (KEV) Used in ransomware campaigns

Confirmed active exploitation — CISA KEV catalog

Name
Microsoft Windows SMBv1 Information Disclosure Vulnerability
Added to catalog
Remediation due date (US federal)
Required action
Apply updates per vendor instructions.

Description

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to obtain sensitive information from process memory via a crafted packets, aka "Windows SMB Information Disclosure Vulnerability."

Metrics

CVSS 3.1
7.5 (HIGH) Score source: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS — exploit probability
100% (percentile: 100) as of 1 November 2026

Affected products

microsoft: windows 10 1507; microsoft: windows 10 1511; microsoft: windows 10 1607; microsoft: windows 7; microsoft: windows 8.1; microsoft: windows rt 8.1; microsoft: windows server 2008; microsoft: windows server 2012; microsoft: windows server 2016; microsoft: windows vista; siemens: acuson p300 firmware; siemens: acuson p300; siemens: acuson p500 firmware; siemens: acuson p500; siemens: acuson sc2000 firmware

References