Microsoft Windows SMBv1 Multiple Vulnerabilities

Tenable plugin 100464 fires when a Windows host still supports SMBv1 and then maps that exposure to the May 2017 SMBv1 bug cluster: info leak (CVE-2017-0267/0268/0270/0271/0274/0275/0276), DoS (CVE-2017-0269/0273/0280), and RCE (CVE-2017-0272/0277/0278/0279). The affected Windows generations called out by Microsoft/NVD are legacy-era builds including Windows 7 SP1, Server 2008 SP2 / 2008 R2 SP1, Windows 8.1, Server 2012 / 2012 R2, early Windows 10 releases through 1703, and Server 2016 when SMBv1 server is enabled.

The vendor HIGH label matches the *theoretical impact* of the worst CVE, but it overstates what this specific plugin actually proves in 2026. Tenable explicitly says the remote check can be inaccurate on newer Windows versions and recommends local patch checks instead; it is really detecting SMBv1 exposure, not reliably proving the host missed a 2017 patch. That friction, plus the lack of cited public exploitation for this exact CVE set, pushes this down to a solid MEDIUM unless you confirm a missing KB locally or find the host exposed on 445/tcp.

Why this verdict

• Baseline starts high: the representative CVE (CVE-2017-0272) is unauthenticated network RCE with NVD/Tenable 8.1 HIGH
• Downshift #1 — attacker reachability is narrower in real estates: exploitation requires direct SMB access on 445, which is usually blocked externally and often segmented internally
• Downshift #2 — the plugin mostly proves SMBv1 support, not missing patches: Tenable says the remote check can be inaccurate on later Windows and recommends local bulletin checks
• Downshift #3 — no strong exploitation evidence for this exact CVE set: Tenable lists no known exploits, and I found no KEV listing for the May 2017 SMBv1 CVEs in this plugin
• Amplifier kept it above LOW: SMBv1 is still dangerous legacy protocol debt, and if the host is truly unpatched the impact is still ugly

Why not higher?

Because this is not the same thing as confirmed MS17-era patch absence. The decisive friction is that the scanner is keying on SMBv1 being enabled, and Tenable itself warns the remote determination can be wrong on newer Windows builds. Without credentialed confirmation or real exposure on 445, calling this HIGH just manufactures urgency.

Why not lower?

I did not drop it to LOW because SMBv1 should not be hanging around in a mature estate, and the worst-case impact behind the finding is still unauthenticated network-side RCE. If one of these hosts is legacy, flat-networked, or externally reachable, the operational risk rises fast even if the plugin is noisy.

1. Validate with credentialed checks — Use Tenable's local Windows bulletin plugins or another credentialed patch source to separate SMBv1 enabled from actually missing May/June 2017 fixes. For a MEDIUM verdict there is no mitigation SLA; do this as the first triage step and then remediate within the 365-day window if it is just protocol debt.
2. Disable SMBv1 where business allows — Turn off the SMBv1 client/server components on hosts that do not have a hard legacy dependency. This removes the protocol attack surface entirely; for a MEDIUM verdict there is no mitigation SLA — go straight to the remediation plan and complete retirement within 365 days.
3. Fence legacy SMB islands — If SMBv1 must remain for old devices or applications, isolate those systems with host firewalls, VLAN segmentation, and strict allowlists for 445/tcp. There is no formal mitigation SLA at MEDIUM, but containment should happen during normal hardening rather than waiting for next year's cleanup.
4. Block internet exposure of SMB — Ensure 445/tcp and 139/tcp are not internet-reachable and are tightly controlled east-west. This matters because the exploit path requires direct network access; treat any external SMB exposure as an exception that should be removed immediately even though the noisgate bucket here is MEDIUM.
5. Audit for active SMBv1 use — Enable SMB auditing and inventory which clients still require SMBv1 so you can retire the dependency instead of preserving it forever for folklore reasons. Use that data to drive application-owner cleanup inside the 365-day remediation window.

Run this on the target Windows host from an elevated PowerShell session. Example: powershell.exe -ExecutionPolicy Bypass -File .\check-tenable-100464.ps1; local admin is recommended because the script queries SMB server configuration, optional features, and installed hotfixes.

# check-tenable-100464.ps1

# Purpose: Triage Tenable plugin 100464 locally.

# Output: VULNERABLE / PATCHED / UNKNOWN

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=ERROR


$ErrorActionPreference = 'Stop'

function Write-Result {
    param(
        [string]$Status,
        [int]$Code,
        [string]$Reason
    )
    Write-Output "$Status - $Reason"
    exit $Code
}

try {
    $os = Get-CimInstance Win32_OperatingSystem
    $caption = $os.Caption
    $version = [version]$os.Version
    $build = [int]$os.BuildNumber

    # Determine whether SMBv1 server support is enabled.

    $smb1Enabled = $null
    try {
        $smbCfg = Get-SmbServerConfiguration -ErrorAction Stop
        $smb1Enabled = [bool]$smbCfg.EnableSMB1Protocol
    }
    catch {
        # Fallback for older hosts: registry/service heuristics.

        try {
            $reg = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters' -ErrorAction Stop
            if ($null -ne $reg.SMB1) {
                $smb1Enabled = ($reg.SMB1 -eq 1)
            }
        }
        catch {}
    }

    # Feature-state hint; SMB1 may be absent entirely on modern hosts.

    $featureState = $null
    try {
        $feature = Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -ErrorAction Stop
        $featureState = $feature.State
        if ($featureState -eq 'Disabled' -or $featureState -eq 'DisabledWithPayloadRemoved') {
            Write-Result 'PATCHED' 0 'SMBv1 optional feature is disabled or removed.'
        }
    }
    catch {}

    if ($smb1Enabled -eq $false) {
        Write-Result 'PATCHED' 0 'SMBv1 server protocol is disabled.'
    }

    if ($null -eq $smb1Enabled -and $null -eq $featureState) {
        Write-Result 'UNKNOWN' 2 'Unable to determine SMBv1 state on this host.'
    }

    # Historical affected trains for the representative May 2017 SMBv1 CVEs.

    $affected = $false
    if ($caption -match 'Windows 7') { $affected = $true }
    elseif ($caption -match 'Windows 8\.1') { $affected = $true }
    elseif ($caption -match 'Windows Server 2008') { $affected = $true }
    elseif ($caption -match 'Windows Server 2012') { $affected = $true }
    elseif ($caption -match 'Windows Server 2016') { $affected = $true }
    elseif ($caption -match 'Windows 10') {
        # Windows 10 through 1703 only. Build 15063 = 1703.

        if ($build -le 15063) { $affected = $true }
    }

    if (-not $affected) {
        Write-Result 'PATCHED' 0 "Host OS build ($caption $($os.Version) build $build) is outside the historical affected version range for the May 2017 SMBv1 CVEs."
    }

    if ($smb1Enabled -ne $true) {
        Write-Result 'UNKNOWN' 2 'OS is historically affected, but SMBv1 state could not be confirmed as enabled.'
    }

    # Patch-state heuristic:

    # Any later cumulative/hotfix activity strongly suggests the 2017 fix set was superseded.

    $latestHotfix = $null
    try {
        $latestHotfix = Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1
    }
    catch {}

    $cutoff = Get-Date '2017-06-13'
    if ($latestHotfix -and $latestHotfix.InstalledOn -ge $cutoff) {
        Write-Result 'PATCHED' 0 "SMBv1 is enabled, but the host has hotfix activity after $($cutoff.ToString('yyyy-MM-dd')); use this as a local triage result and still retire SMBv1."
    }

    if ($latestHotfix -and $latestHotfix.InstalledOn -lt (Get-Date '2017-05-09')) {
        Write-Result 'VULNERABLE' 1 'SMBv1 is enabled on a historically affected OS and no hotfixes later than 2017-05-09 were found.'
    }

    Write-Result 'UNKNOWN' 2 'SMBv1 is enabled on a historically affected OS, but patch state was not conclusively proven from local hotfix data. Use credentialed bulletin checks for confirmation.'
}
catch {
    Write-Error $_.Exception.Message
    exit 3
}

Sources

1. Tenable Nessus Plugin 100464
2. Microsoft Security Advisory 4025685
3. NVD CVE-2017-0272
4. Microsoft: Detect, enable, and disable SMBv1/v2/v3
5. Microsoft: SMBv1 not installed by default
6. CISA Known Exploited Vulnerabilities Catalog
7. CISA Vulnerability Summary for week of May 15, 2017
8. Nmap smb-protocols NSE documentation