Microsoft Windows SMBv1 Information Disclosure Vulnerability

HOCH 7.5EXPLOITED (CISA KEV)CVE-2017-0147 · Published 17/03/2017 · updated 17/06/2026

Microsoft Windows SMBv1 Information Disclosure Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 24/05/2022. Patch affected systems as an emergency. It is known to be used in ransomware campaigns.

Package	Affected versions	Patched versions
SMBv1 server Microsoft	Versions not published yet (product named by CISA KEV)

Description

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to obtain sensitive information from process memory via a crafted packets, aka "Windows SMB Information Disclosure Vulnerability."

References

packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html · Exploit
packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html · Exploit
securityfocus.com/bid/96709 · Broken Link
securitytracker.com/id/1037991 · Broken Link
cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf · Third Party Advisory
cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf · Third Party Advisory
ics-cert.us-cert.gov/advisories/ICSMA-18-058-02 · Third Party Advisory
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0147 · Patch
exploit-db.com/exploits/41891 · Exploit
exploit-db.com/exploits/41987 · Exploit
exploit-db.com/exploits/43970 · Exploit
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2017-0147

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free