PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-0144 Microsoft CVE debrief

CVE-2017-0144 is a Microsoft SMBv1 remote code execution vulnerability that CISA lists in its Known Exploited Vulnerabilities catalog. The supplied KEV metadata marks it as known exploited and notes known ransomware campaign use, which makes this a high-priority remediation item for any environment that still depends on SMBv1. CISA added the entry on 2022-02-10 and set a remediation due date of 2022-08-10; the source guidance is to apply updates per vendor instructions.

Vendor
Microsoft
Product
SMBv1
CVSS
HIGH 8.8
CISA KEV
Listed
Original CVE published
2022-02-10
Original CVE updated
2022-02-10
Advisory published
2022-02-10
Advisory updated
2022-02-10

Who should care

Windows and infrastructure teams, security operations, incident responders, and asset owners should care most if any Microsoft systems still have SMBv1 enabled or exposed. Organizations with legacy file-sharing dependencies, older Windows hosts, or mixed environments should treat this as urgent.

Technical summary

The vulnerability affects Microsoft SMBv1 and is identified by CISA as a known exploited remote code execution issue. The source corpus does not provide additional exploit mechanics, so the defensive takeaway is straightforward: SMBv1 exposure on affected Microsoft systems should be eliminated or remediated with vendor-recommended updates and hardening. The KEV record also indicates known ransomware campaign use, increasing operational risk.

Defensive priority

Urgent. This is a CISA KEV entry with known exploitation and known ransomware campaign use, so remediation should be prioritized immediately over routine patch scheduling.

Recommended defensive actions

  • Apply Microsoft updates per vendor instructions for affected systems.
  • Disable SMBv1 wherever it is not strictly required.
  • Inventory hosts and appliances that still rely on SMBv1 and plan migration off the protocol.
  • Prioritize remediation on critical, internet-facing, and high-value internal systems first.
  • Validate that SMBv1 is no longer enabled after remediation and monitor for any systems that still require exception handling.

Evidence notes

The evidence base here is the supplied CISA KEV metadata and official record links. The KEV entry explicitly marks CVE-2017-0144 as known exploited, notes known ransomware campaign use, and instructs applying updates per vendor instructions. The corpus does not include a CVSS score or vendor bulletin text, so the debrief avoids unsupported severity claims.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-0144 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-0144

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-0144 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-0144

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.