PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-0144 Microsoft CVE debrief

CVE-2017-0144 is a Microsoft SMBv1 remote code execution vulnerability that CISA lists in its Known Exploited Vulnerabilities catalog. The supplied KEV metadata marks it as known exploited and notes known ransomware campaign use, which makes this a high-priority remediation item for any environment that still depends on SMBv1. CISA added the entry on 2022-02-10 and set a remediation due date of 2022-08-10; the source guidance is to apply updates per vendor instructions.

Vendor
Microsoft
Product
SMBv1
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2022-02-10
Original CVE updated
2022-02-10
Advisory published
2022-02-10
Advisory updated
2022-02-10

Who should care

Windows and infrastructure teams, security operations, incident responders, and asset owners should care most if any Microsoft systems still have SMBv1 enabled or exposed. Organizations with legacy file-sharing dependencies, older Windows hosts, or mixed environments should treat this as urgent.

Technical summary

The vulnerability affects Microsoft SMBv1 and is identified by CISA as a known exploited remote code execution issue. The source corpus does not provide additional exploit mechanics, so the defensive takeaway is straightforward: SMBv1 exposure on affected Microsoft systems should be eliminated or remediated with vendor-recommended updates and hardening. The KEV record also indicates known ransomware campaign use, increasing operational risk.

Defensive priority

Urgent. This is a CISA KEV entry with known exploitation and known ransomware campaign use, so remediation should be prioritized immediately over routine patch scheduling.

Recommended defensive actions

  • Apply Microsoft updates per vendor instructions for affected systems.
  • Disable SMBv1 wherever it is not strictly required.
  • Inventory hosts and appliances that still rely on SMBv1 and plan migration off the protocol.
  • Prioritize remediation on critical, internet-facing, and high-value internal systems first.
  • Validate that SMBv1 is no longer enabled after remediation and monitor for any systems that still require exception handling.

Evidence notes

The evidence base here is the supplied CISA KEV metadata and official record links. The KEV entry explicitly marks CVE-2017-0144 as known exploited, notes known ransomware campaign use, and instructs applying updates per vendor instructions. The corpus does not include a CVSS score or vendor bulletin text, so the debrief avoids unsupported severity claims.

Official resources

Publicly disclosed and present in CISA’s Known Exploited Vulnerabilities catalog. The supplied timeline places the KEV addition on 2022-02-10 with a due date of 2022-08-10.