← Vulnerability Intelligence

CVE-2017-0148

High 8.1 Exploited in the wild (KEV) Used in ransomware campaigns

Confirmed active exploitation — CISA KEV catalog

Name
Microsoft SMBv1 Server Remote Code Execution Vulnerability
Added to catalog
Remediation due date (US federal)
Required action
Apply updates per vendor instructions.

Description

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, and CVE-2017-0146.

Metrics

CVSS 3.1
8.1 (HIGH) Score source: NVD CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS — exploit probability
99% (percentile: 100) as of 1 November 2026
CWE
CWE-20

Affected products

microsoft: server message block; microsoft: windows 10 1507; microsoft: windows 10 1511; microsoft: windows 10 1607; microsoft: windows 7; microsoft: windows 8.1; microsoft: windows rt 8.1; microsoft: windows server 2008; microsoft: windows server 2012; microsoft: windows server 2016; microsoft: windows vista; siemens: acuson p300 firmware; siemens: acuson p300; siemens: acuson p500 firmware; siemens: acuson p500

References