Microsoft published the MS17-010 fix for SMBv1 on 14 March 2017. The WannaCry ransomware began spreading on 12 May 2017, about two months later, using the EternalBlue exploit against that same flaw. For organisations that had applied the update, the worm had little to spread through. The gap between patch and outbreak is the lesson.
The timeline
- 14 March 2017. Microsoft publishes bulletin MS17-010, rated Critical for all supported Windows releases. It says an unauthenticated attacker could send a specially crafted packet to an SMBv1 server and execute code.
- 12 May 2017. CISA's alert says researchers found the ransomware that morning, with reports of spread beginning around 4:00 AM Eastern.
- 13 May 2017. Microsoft releases patches for unsupported systems such as Windows XP, Windows 8 and Windows Server 2003, per CISA.
- 7 June 2018. CISA updates the alert to attribute the malware to the North Korean government.
How it spread
CISA says WannaCry propagated using the MS17-010 exploit, known as EternalBlue, against SMBv1. The dropper scanned local network ranges and attempted to infect any host with port 445 open. Phishing was also a possible route in. Once inside a flat network, it moved on its own, which is why it is described as a worm.
Microsoft's bulletin notes that it identified no mitigating factors for the vulnerabilities and offered one workaround: disable SMBv1.
Why the patch gap existed
Reasons teams were still exposed are familiar. Systems were not inventoried. Patching needed change windows that were not approved. Legacy machines could not take the update. SMB was reachable between segments that did not need it.
What CISA recommended
- Apply MS17-010. If you cannot, disable SMBv1 and block SMB traffic at network boundaries, accepting the impact on file sharing.
- Limit administrator privileges and apply least privilege to shares.
- Keep offline, tested backups.
- Filter email and disable Office macros from external mail.
- Do not block the kill-switch domain the dropper contacts, since connecting to it made the malware stop.
Shortening your own gap
- Measure the time from a patch being published to it being deployed on internet facing and internal systems. Report the median and the slowest.
- Maintain a list of systems that cannot be patched and put compensating controls on each: segmentation, disabled protocols, extra monitoring.
- Turn off protocols nobody uses. Disabling SMBv1 was a documented step.
- Segment so that one infected machine cannot reach all others on port 445.
- Track known exploited vulnerabilities as a separate, faster queue.
Click through it at your own pace, or open it full screen.
Safeguard's continuous scanning, policies and gates help keep that median visible. Try a free scan at gold.safeguard.sh/scan.
Quick check
Was there a fix before WannaCry spread?
Yes. Microsoft published MS17-010 on 14 March 2017, and WannaCry was found on 12 May 2017.
Should you block the kill-switch domain?
No. CISA says doing so stops that safeguard from working.
Sources
Last reviewed: 19 October 2026.
