<p>Almost three months ago we have <a href="https://www.wincert.net/cast/microsoft-accidentally-leaks-unpatched-wormable-exploit-in-smbv3-protocol/" target="_blank" rel="noopener noreferrer">published an article</a> about an accidental leak of unpatched wormable Windows 10 SMBGhost exploit in SMBv3 protocol.</p>
<p><img class="alignnone size-full wp-image-3571" src="https://www.wincert.net/wp-content/uploads/2020/03/security-2688911_640.jpg" alt="" width="640" height="359" /></p>
<p>Today, the U.S Government cybersecurity agency has confirmed this vulnerability and warns Windows 10 users about ongoing malicious cyberattacks targeting systems that are still vulnerable by this three months old flaw.</p>
<p>A remote code execution flaw exists in the way how Microsoft&#8217;s SMBv3 protocol handles certain requests. Basically, it allows for a maliciously constructed data packet sent to the server to run the arbitrary code execution.</p>
<p>Even though the patch has been released not all Windows 10 PCs have it installed and thus are still vulnerable. Because this is a worm-type exploit it can spread rapidly between vulnerable systems.</p>
<p>Microsoft&#8217;s security update addressing the SMBGhost vulnerability for both Windows 10 1903 and 1909 versions can be found <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796" target="_blank" rel="noopener noreferrer">here</a>.</p>