Windows 10 Critical Exploit Now Confirmed, Months After Microsoft’s Emergency Update

U.S. Government cybersecurity agency warns malicious cyber actors are targeting Windows 10 systems still vulnerable to a three-month-old critical security flaw.

Cast your mind back to March 10 when the monthly Windows Patch Tuesday security updates were released by Microsoft. That same day, one critical Windows 10 vulnerability was disclosed by mistake ; disclosed before a fix had been made available.

CVE-2020-0796 , better known today as SMBGhost, was thought so dangerous were it to be weaponized that it merited that rarest of common vulnerability scoring system (CVSS) ratings: a “perfect” 10 . Microsoft was quick to act. It issued an emergency out of band fix within days.

MORE FROM FORBES Windows Security Alert: Core System File Zero-Days Confirmed Unpatched By Davey Winder

That’s where the good news ends.

SMBGhost is a fully wormable vulnerability that could enable remote and arbitrary code execution and, ultimately, control of the targeted system if a successful attack was launched. The vulnerability, in Microsoft’s Server Message Block 3.1.1, allows for a maliciously constructed data packet sent to the server to kick off the arbitrary code execution.

Such an attack would require both an unpatched and vulnerable Windows 10 or Windows Server Core machine and, crucially, working and available exploit code. The former should have been sorted by the emergency update being applied automatically, but that assumes every device at risk would have automatic updates enabled.

MORE FROM FORBES Microsoft Turns Bizarre To 11 With Fingerprint Scanning Headphones By Davey Winder

This is not the case, for a myriad of reasons, and leaves systems and data exposed.

Especially seeing as the U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) has just confirmed that it is aware of “publicly available and functional” proof of concept (PoC) exploit code.

What’s more, the CISA posting warns, “malicious cyber actors are targeting unpatched systems with the new PoC, according to recent open-source reports.”

MORE FROM FORBES Don’t Press Windows 10 2004 ‘Update Now’ Button, Microsoft Warns Some Users By Davey Winder

The CISA has said that it “strongly recommends using a firewall to block SMB ports from the internet,” and that the application of patches and updates for such critical vulnerabilities should be applied as soon as possible.

I reached out to Microsoft, and a spokesperson provided the following statement: “We recommend customers install updates as soon as possible as publicly disclosed vulnerabilities have the potential to be leveraged by bad actors. An update for this vulnerability was released in March, and customers who have installed the updates, or have automatic updates enabled, are already protected.”

Microsoft’s security updates addressing SMBGhost in Windows 10 version 1909 and 1903 and Server Core for the same versions, can be found here .

MORE FROM FORBES Microsoft Sounds Windows 10 ‘Exploitation More Likely’ Alarm: Here’s Exactly What That Means By Davey Winder

—

Updated June 9 with a statement from Microsoft