CVE-2017-0146

SMBv1 is an older Windows file-sharing protocol. This vulnerability is a weakness in the SMBv1 server that can be triggered over the network by a malicious request. Think of it like a door in a warehouse that was meant to be locked, but a break-in method was later discovered and then used in real ransomware attacks.

This matters if you run or manage any Microsoft Windows systems with the SMBv1 server component enabled—listed Windows include Windows Vista Service Pack 2, Windows Server 2008 Service Pack 2 and R2 Service Pack 1, Windows 7 Service Pack 1, Windows 8, Windows 8.1, Windows Server 2012 (Gold and R2), Windows RT 8.1, and Windows 10 (Gold, 1511, 1607). It’s mainly a risk when attackers can reach SMBv1 over the network (commonly via TCP 445), such as from internal segments, VPN/remote access paths, or the internet.

This is RED because it is listed by CISA in its Known Exploited Vulnerabilities program and has been used in ransomware campaigns. Public exploits exist, meaning attackers can likely use this vulnerability without much effort once SMBv1 is reachable. Treat any machine with SMBv1 enabled and network-reachable as an active, high-priority risk.