VulnRadar

Data against noise.

Page generated: 08 Nov 2026, 13:41 UTC

CVE-2017-0144

Read full description

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.

CVSS 8.8 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE

0.0/10

REALITY · THREAT PRIORITY

8.8/10

General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?

Recorded exploitation baseline: +7.00
Technical severity: CVSS 8.8: +1.32
Fresh EPSS: 99.23%: +0.50

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 25 documents and public datasets.

Hype components

Headline sample (25%)

0/100

Press, 30 days (60%)

0/100

Grounded branding (15%)

0/100

HYPE TOTAL0/100

Sources and documents

Huntress

Press · 05 Dec 2025, 08:00 · CVE-2017-0144 Vulnerability: Analysis, Detection, Removal - Huntress

The Hacker News

Press · 18 Aug 2025, 07:00 · Microsoft Windows Vulnerability Exploited to Deploy PipeMagic RansomExx Malware - The Hacker News

SentinelOne

Press · 27 Apr 2025, 07:00 · EternalBlue Exploit: What It Is And How It Works? - SentinelOne

SOC Prime

Press · 10 Oct 2024, 07:00 · LemonDuck Malware Detection: Exploits CVE-2017-0144 and Other Microsoft's Server Message BlockSMB Vulnerabilities for Cryptocurrency Mining - SOC Prime

Trellix

Press · 20 Oct 2023, 09:50 · What Is Petya and NotPetya Ransomware? - Trellix

See all 25 source documents

EclecticIQ Blog

Press · 13 May 2020, 07:00 · WannaCry 3 Years Later, Could it Happen Again? - EclecticIQ Blog

Google Cloud

Press · 15 Feb 2018, 08:00 · CVE-2017-10271 Used to Deliver CryptoMiners: An Overview of Techniques Used Post-Exploitation and Pre-Mining - Google Cloud

Infosecurity Magazine

Press · 02 Feb 2018, 08:00 · Over 500,000 Windows Machines Infected with Monero Mining Software - Infosecurity Magazine

Palo Alto Networks

Press · 25 Jan 2018, 08:00 · UPDATED: Palo Alto Networks Protections Against WanaCrypt0r Ransomware Attacks - Palo Alto Networks

Check Point Research

Press · 29 Sep 2017, 07:00 · EternalBlue – Everything There Is To Know - Check Point Research

Microsoft

Press · 27 Jun 2017, 07:00 · New ransomware, old techniques: Petya adds worm capabilities - Microsoft

Palo Alto Networks

Press · 27 Jun 2017, 07:00 · Palo Alto Networks Protections for Petya Ransomware - Palo Alto Networks

Check Point Research

Press · 25 May 2017, 07:00 · BROKERS IN THE SHADOWS: Analyzing vulnerabilities and attacks spawned by the leaked NSA hacking tools - Check Point Research

Unit 42

Press · 16 May 2017, 07:00 · Threat Brief: WanaCrypt0r– What We Know - Unit 42

BleepingComputer

Press · 15 May 2017, 07:00 · With the Success of WannaCry, Imitations are Quickly In Development - BleepingComputer

BleepingComputer

Press · 15 May 2017, 07:00 · WannaCry Ransomware Version With Second Kill Switch Detected and Shut Down - BleepingComputer

The Guardian

Press · 15 May 2017, 07:00 · How to protect your computer against the ransomware attack - The Guardian

McAfee

Press · 14 May 2017, 07:00 · Further Analysis of WannaCry Ransomware - McAfee

BleepingComputer

Press · 13 May 2017, 07:00 · Microsoft Releases Patch for Older Windows Versions to Protect Against Wana Decrypt0r - BleepingComputer

Kaspersky

Press · 13 May 2017, 07:00 · WannaCry: Are you safe? - Kaspersky

The Guardian

Press · 12 May 2017, 07:00 · What is WannaCry ransomware and why is it attacking global computers? - The Guardian

Malwarebytes

Press · 12 May 2017, 07:00 · The worm that spreads WanaCrypt0r - Malwarebytes

Help Net Security

Press · 12 May 2017, 07:00 · Massive ransomware campaign spreading around the world like wildfire - Help Net Security

Malwarebytes

Press · 12 May 2017, 07:00 · WanaCrypt0r ransomware hits it big just before the weekend - Malwarebytes

BleepingComputer

Press · 12 May 2017, 07:00 · WannaCry / Wana Decryptor / WanaCrypt0r Info & Technical Nose Dive - BleepingComputer

Score evolution

● Hype ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.8 (2026-11-02 15:12). The curve appears once the score changes.

Public exploit evidence

Public exploit entries / repo candidates

Source entries and unverified repository candidates are counted separately.

Public exploit evidence

exploitdb #41891 2017-04-17
exploitdb #41987 2017-05-10
exploitdb #42030 2017-05-17
exploitdb #42031 2017-05-17
exploitdb #42315 2017-07-11
exploitdb #47456 2019-10-02

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence: Exploitation recorded
Priority basis: Recorded exploitation; CVSS 8.8; EPSS 99.2%
Attention, last 30 days: 0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential: network access, low privileges, no user interaction.
Observed activity: Exploitation recorded in CISA KEV.
Known scale: Not quantified.
Evidence confidence basis: Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:57:47.671864+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline

Published

17 Mar 2017, 00:00

First press mention

12 May 2017, 07:00

Added to the CISA KEV catalog

10 Feb 2022, 00:00

Latest press mention

05 Dec 2025, 08:00

Score calculated

05 Nov 2026, 13:57

PoCs on GitHub

6 repositories