Critical
KEV + Ransomware
CVE-2017-0144
WannaCry Ransomware Attacks Exploiting Microsoft SMBv1 Vulnerability
Vendor / product: Microsoft SMBv1
Event date: 2017-05-12
Victim organization: Maersk
Public PoC: Yes
First tracked by RiskWire: 2026-11-04
CISA KEV catalog
Added to KEV
Federal remediation due
2022-08-10 (1547 days overdue)
Ransomware campaign use
Known
CISA description
The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.
Required action
Apply updates per vendor instructions.
Named threat actors
Lazarus Group (APT38)
Sources & citations (1)
- The Patch You Didn't Have to Install: Why Secure Configuration Outlasts the Zero-Day Race cisecurity.org · 2026-11-03
References
See CVE-2017-0144 in context
RiskWire tracks every exploited CVE this week, cross-referenced against CISA KEV with federal remediation deadlines. Filtered to your vendor stack.
Book a 20-min demo →