Microsoft corporation windows smb, remote code execution: 4 records, one defect family
Microsoft corporation windows smb has been reported 4 separate times for the same kind of mistake, Remote Code Execution, all published on 2017-03-17. A defect family is our own grouping of the CVE corpus: every record naming one product and one weakness class, collected so a repeat is visible as a repeat. No public source publishes this, and what this page counts is how often this one product has gone wrong in this one way.
What this page is, and what it is not
The records are public. This grouping is not. No source publishes defect families, so we built them: every record in the corpus sorted by the product an authority named and the weakness class carried with it, 21316 families over 105586 records. This one holds every record that names Microsoft corporation windows smb and carries Remote Code Execution, matched character for character. We show the join because a grouping you cannot check is a grouping you should not cite.
That is 4 filings, all published on 2017-03-17, landing on the same weakness class in the same product. At this count it is a repeat rather than a pattern, and the roster below is short enough to read in full. This is what we held on 2026-09-20.
A repeat is evidence about where to look. If you are reviewing Microsoft corporation windows smb, the records below say which mistake has already been found more than once, which is the cheapest place a reviewer can start. If you are asking the vendor a question, a count under one weakness class is a better question than any single record is.
What this page cannot tell you is decided by what was joined. A product name and a weakness class settled membership, so those two values are the whole of what the page asserts. Records here may sit in the same line of code or in unrelated parts of the product, and we hold no value that separates those cases. A fixed version named in one record closes that record and says nothing about the others. And nothing here describes anyone's systems, because no value in this family connects a product name to an installation.
The names the authorities used
One spelling, used by every authority that filed one of these records: microsoft corporation windows smb.
Family membership: held values. Joined on the product and weakness class the assigning authorities wrote, with no model involved.
What the records offer
No record in this family publishes a fixed version in held sources.
4 records are listed by CISA with a required action, which carries a federal remediation deadline on its own page.
What this family was researched, not held
SMBv1 records patched on one day in 2017, exploited for years after
These records all describe the same place: the way the SMB version 1 server handles specially crafted requests. Microsoft published them together in bulletin MS17-010 on March 14, 2017, rated it Critical for all supported Windows releases, listed five remote code execution entries and one information disclosure entry, and said the update corrects how SMBv1 handles those requests. At release Microsoft marked every one of them as not publicly disclosed and not exploited. Two months later CISA reported WannaCry ransomware spreading through the MS17-010 SMB vulnerability and told organisations to apply the March 14 patch or disable SMBv1. Microsoft had already deprecated SMBv1 in 2014, stopped installing it by default from Windows 10 version 1709, and now advises that it should not be reinstalled.
The condition these records share is the presence of the SMB version 1 protocol, not a single unpatched machine. CISA lists each of them as used in known ransomware campaigns, and its required action on each is to apply vendor updates. Checking whether SMBv1 is installed anywhere you own answers more than tracking the records one at a time.
This note establishes only that the records read alike: one protocol, one bulletin, one kind of remote code execution. It does not say they are the same vulnerability, that they describe your estate, or that the update for one closes another.
Written from learn.microsoft.com, cisa.gov, learn.microsoft.com, cisa.gov. Stated at high confidence. Nothing in this box is a value the index holds, and none of it opens a receipt.
What tells these apart
Nothing held does. Every record here carries the same title, or none, the same weakness class, and the same publication day, and the index holds no distinguishing value for any of them. The rows below are listed by identifier for that reason. That is the state of the sources, not a gap in this page.
What this page does not cover
This is a family of records that read alike. It is not a shared vulnerability, not an inventory, and not a statement that one fix closes the rest. Each record's own state, its own dates and its own receipts are on its own page.
Grouped by shared product and weakness, not by shared vulnerability. Each record's own state is on its own page.
Everything this vendor has, including records outside this family:
4 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.