CVE-2017-0147VulnerabilityPublished 05/24/2022Updated 10/24/2026

CVE-2017-0147: Microsoft Windows SMBv1 Information Disclosure Vulnerability

Affects Microsoft SMBv1 serverSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 05/24/2022
KEV deadline: 06/14/2022
Ransomware: Used in ransomware campaigns
EPSS: 99.7% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2017-0147 (opens in a new tab)

Description

CVE-2017-0147 is a high-severity information disclosure vulnerability in the Microsoft Windows SMBv1 server. It allows remote attackers to obtain sensitive information from process memory by sending crafted packets. This vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns.

Summary

The SMBv1 server component in Microsoft Windows contains an information disclosure vulnerability identified as CVE-2017-0147. Remote attackers can exploit this flaw by sending specially crafted packets to the SMBv1 server, which results in unauthorized disclosure of sensitive information from process memory. This vulnerability has been actively exploited in the wild, including use in ransomware campaigns, underscoring its critical security impact.

Impact

Successful exploitation of this vulnerability allows remote attackers to access sensitive information from the memory of the SMBv1 server process. This can lead to information leakage that may facilitate further attacks or compromise of the affected system. The vulnerability has been exploited in real-world attacks, including ransomware campaigns, indicating a significant threat to affected systems.

Mitigation

The vendor advisory or patch status is not provided in the available data. Patch status is not yet confirmed — check the Microsoft advisory for current remediation guidance. Given the known exploitation, disabling SMBv1 or applying official patches from Microsoft, if available, is recommended.

Weaknesses

CWE-200Information Exposure (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 11:42:39 UTC

Weaknesses

References

Related threats