CVE-2017-0004

Exploitation likely. EPSS gives it a 91% chance of exploitation in the next 30 days. A vendor fix is available.

CVSS 3.07.5High EPSS percentile99th91% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2017-01-10Updated 2026-05-06Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether you run Microsoft Windows Vista Service Pack 2, Windows 7 Service Pack 1, or Windows Server 2008/2008 R2 Service Pack 2/Service Pack 1 as listed for this CVE.
Identify the presence of the vendor’s remediation described in Microsoft bulletin MS17-004 for LSASS denial-of-service.
Apply the Microsoft update from MS17-004 to the affected Windows machines (install/upgrade until you reach the fixed state for your specific Windows edition).
Reboot the affected systems after installing the update, and verify normal operation.

Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

The Local Security Authority Subsystem Service (LSASS) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to cause a denial of service (reboot) via a crafted authentication request, aka "Local Security Authority Subsystem Service Denial of Service Vulnerability."

In plain language

Written by AI from the record

This Windows LSASS denial-of-service weakness could let a remote attacker crash/reboot your system without needing a login; small businesses should treat it as a high-priority Windows update for affected versions.

CWE-20 remote denial-of-service (system crash/reboot) in the Local Security Authority Subsystem Service (LSASS) on Microsoft Windows Vista Service Pack 2, Windows Server 2008 Service Pack 2 and R2 Service Pack 1, and Windows 7 Service Pack 1 via a crafted authentication request; no public exploit code was found in the records, but predicted attacker interest is high.

If you're affected

System crash and forced reboot
Service outage for employees/customers
Loss of business continuity
Potential secondary disruption risk

What is it

LSASS is a Windows component that helps manage security/authentication. This bug can be triggered by a remote, specially made request that can overwhelm or crash LSASS, leading to a forced reboot—like someone sending a malicious instruction that causes your security system to fall over.

Who is affected

This matters if you run the listed older Windows client/server versions: Windows Vista Service Pack 2, Windows 7 Service Pack 1, Windows Server 2008 Service Pack 2, and Windows Server 2008 R2 Service Pack 1. It’s most relevant when the vulnerable machine is reachable by an attacker over the network, because the denial-of-service can be triggered without a login and the records indicate no need for user interaction.

How urgent is it

Treat this as AMBER: attackers could cause a remote denial of service that forces reboots, which can create real downtime for a small business. Even though there’s no public exploit code on record and it’s not in the CISA KEV list, the predicted likelihood of attack is very high and trending upward, so patching should be prioritized on affected systems.

What to do — in detail

Confirm affected systems
- For each server/PC, check the Windows edition and service pack level. This CVE targets exactly the versions named: Windows Vista Service Pack 2, Windows 7 Service Pack 1, Windows Server 2008 Service Pack 2, and Windows Server 2008 R2 Service Pack 1.
Confirm patch availability and apply Microsoft remediation
- Use Microsoft’s remediation referenced for this issue (MS17-004). Apply it to each affected machine until the machine is in the fixed state for your branch/edition as described by Microsoft.
- If you have multiple update channels/environments (production, staging), test in staging first, then roll out to production.
Reboot and verify
- Reboot after installing the update (especially if Windows Installer indicates it’s required) and verify that services and logon/authentication-related operations behave normally.
Temporary risk reduction if you cannot patch immediately
- Reduce network exposure to the affected Windows hosts (limit which networks and machines can reach them). Because the issue is triggered remotely without a login, the key mitigation is narrowing who can connect to those systems.
What to monitor after patching
- Watch for unusual authentication-related errors and system restarts/reboots on those systems. A successful remediation should stop this specific crash/reboot pattern associated with the vulnerability.
Timing
- No CISA KEV due date was provided in the findings (KEV is not listed for this CVE). Proceed with MS17-004 rollout on affected machines as soon as possible.

Technical context

Severity is high due to availability impact: remote denial of service causing reboot (CWE-20). The attack mechanism is a crafted authentication request sent to LSASS, triggering a crash/reboot condition. Exploitation status: no public exploit code was found in the records, and the CVE is not listed in CISA KEV. However, predicted likelihood is very high (EPSS prediction indicated 91.4% with a rising trend), which is why urgency is AMBER. This page should focus on whether the vulnerable Windows version is exposed to the network; if reachable, attackers can attempt the crafted request without needing a login or user interaction.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

91% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

26 events over 3543 days, from the signal feeds we watch.

2026-09-23EPSS band changehigh → criticalepss band change
2026-09-21EPSS band changecritical → highepss band change
2026-09-06EPSS band changehigh → criticalepss band change
2026-09-05EPSS band changecritical → highepss band change
2026-08-31EPSS band changehigh → criticalepss band change
2026-08-29EPSS band changecritical → high

Affected products

Microsoft Corpcommercial · USaka microsoft, microsoft corporation

And 3 more affected products. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Scored 7.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality NoneNo confidentiality impact
Integrity NoneNo integrity impact
Availability HighTotal denial of service — the component is completely unavailable