CVE-2017-11815

Exploitation likely. EPSS gives it a 13% chance of exploitation in the next 30 days. A vendor fix is available.

CVSS 3.05.3Medium EPSS percentile96th13% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2017-10-13Updated 2026-05-13Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Microsoft Corporation Server Block MessageAffected: Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1,…Upgrade to: not statedStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your affected Windows computers or servers have the SMB service enabled and whether Microsoft security updates for CVE-2017-11815 are installed.
Install the applicable Microsoft security update from the Microsoft advisory; the findings do not provide a single fixed version number.
Limit SMB access to trusted internal networks and review which basic user accounts can reach file-sharing servers.

Vendor advisory Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

The Microsoft Server Block Message (SMB) on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, allows an information disclosure vulnerability in the way that it handles certain requests, aka "Windows SMB Information Disclosure Vulnerability".

In plain language

Written by AI from the record

This affects the Server Block Message (SMB) service on listed Windows 7, Windows 8.1, Windows 10, Windows Server 2008, 2012, and 2016 releases; typical small businesses should apply Microsoft’s available security updates during normal maintenance.

Authenticated network information disclosure in Windows SMB: a low-privileged user can send crafted SMB requests to retrieve sensitive server information.

If you're affected

Sensitive server data exposure
Internal information disclosure
Privacy risk

What is it

This is a flaw in Windows file sharing that may reveal information stored or handled by a server to a user who should not be able to see it. It is like a locked filing cabinet that can be made to show parts of its contents when someone sends it a specially formed request.

Who is affected

This matters to you if you use or run Server Block Message (SMB) on affected Windows computers or servers. An attacker needs a basic user account, but does not need someone to click anything; the risk depends on whether they can reach the SMB service.

How urgent is it

No confirmed real-world exploitation is reported, and no public exploit code is on record. Treat this as a routine update priority: address it in planned maintenance, especially on file-sharing servers accessible by many users.

What to do — in detail

Confirm exposure by identifying systems running the affected Windows releases, verifying that the SMB service is active, and checking installed Microsoft updates against the vendor advisory. The findings do not specify fixed version numbers or separate supported branches; use the update applicable to each operating-system release in Microsoft’s advisory. If patching is delayed, restrict SMB to trusted network segments and limit access to authorized accounts. No CISA KEV due date applies because this CVE is not listed in KEV. Monitor Microsoft update deployment status and SMB access records for unusual requests from ordinary user accounts.

Technical context

CVSS v3.0 score: 5.3 (Medium), vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N. CWE-200 information disclosure over the network, requiring low privileges and no user interaction. It is not listed in CISA KEV, and no public exploit code is on record. EPSS predicts a 13.3% likelihood and is falling (96th percentile); this is predictive rather than evidence of exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

13% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

23 events over 3267 days, from the signal feeds we watch.

2026-09-23EPSS band changelow → moderateepss band change
2026-09-21EPSS band changemoderate → lowepss band change
2026-09-06EPSS band change0 → moderateepss band change
2026-09-05EPSS band changemoderate → 0epss band change
2026-08-31EPSS band change0 → moderateepss band change
2026-08-29EPSS band changemoderate → low

Affected products

microsoftcommercial · US
- windows 10OSOn-premOperating Systems / windows
- windows 7OSOn-premOperating Systems / windows
- windows 8.1OSOn-premOperating Systems / windows
- windows rt 8.1OSOn-premOperating Systems / windows
- windows server 2008OSOn-premOperating Systems / windows
- windows server 2012OSOn-premOperating Systems / windows
- windows server 2016OSOn-premOperating Systems / windows
Microsoft Corporationcommercial · USaka microsoft
- Server Block Message (SMB)On-premOperating Systems / windows

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Scored 5.3 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact