Disable SMBv1 to Remove the Attack Surface Exploited by EternalBlue and WannaCry

An attacker or worm on the same network segment can scan for open port 445, probe for SMBv1 support, and exploit EternalBlue or related vulnerabilities for unauthenticated remote code execution as SYSTEM. WannaCry demonstrated this at global scale, spreading to over 200,000 systems in hours. Disabling SMBv1 provides complete protection against this entire class of attack.

SMBv1 is a 30-year-old file-sharing protocol with numerous well-documented security vulnerabilities. The NSA-developed EternalBlue exploit (CVE-2017-0144) targets SMBv1 and was used in the WannaCry and NotPetya ransomware outbreaks. Windows Server enables SMBv1 by default for backward compatibility. Any server with SMBv1 enabled is a potential hop point in lateral movement and vulnerable to unauthenticated exploitation by worm-type malware that traverses networks looking for the SMBv1 port.

Probably yes if any of these apply:

During the WannaCry outbreak in May 2017, every organisation with SMBv1-enabled Windows servers that was reachable from an infected system was at risk of compromise. Hospitals, telecoms, and manufacturers lost entire networks within hours. Microsoft had released a patch (MS17-010) two months earlier, but organisations that had patched but not disabled SMBv1 remained vulnerable to other SMBv1-based exploits.