Port 445 Vulnerability: Is It Safe, and How to Close SMB Exposure

The port 445 vulnerability is the security risk of exposing Server Message Block (SMB) traffic, which runs over TCP port 445, to an untrusted network. Attackers target port 445 for wormable remote code execution, ransomware, and lateral movement, and it drove the 2017 WannaCry outbreak through the EternalBlue exploit. This guide covers the key CVEs, how to check whether port 445 is open, how to close it, and how to fix and harden SMB so your team removes the exposure before an attacker reaches it.

Short answer: Port 445 carries SMB (Server Message Block) file-sharing traffic. It becomes a vulnerability when exposed to untrusted networks, where attackers exploit CVEs such as EternalBlue (CVE-2017-0144) and SMBGhost (CVE-2020-0796) for wormable remote code execution and ransomware. Fix it by blocking 445 at the perimeter, disabling SMBv1, requiring SMBv3 with signing, and patching promptly. Never expose port 445 to the public internet.

What is port 445, and what is SMB?

Port 445 is the TCP port that carries Server Message Block (SMB), the protocol Windows uses to share files, printers, and other resources across a network. Its registered service name is microsoft-ds (Microsoft Directory Services). Microsoft moved SMB directly onto TCP port 445 with the release of Windows 2000, replacing the older arrangement that ran SMB over NetBIOS on ports 137 to 139. Every modern Windows file server, domain controller, and workstation listens on 445 by default, and that default is exactly the problem. SMB is essential inside a trusted network. The same port that lets your team share a folder also lets an attacker reach the file-sharing stack directly. Our explainer on what an open port is in cyber security sets the wider context.

What are ports 139 and 445 used for?

Port 139 carries SMB over NetBIOS (the legacy SMBv1 dialect), and port 445 carries SMB directly over TCP (SMBv2 and SMBv3). Knowing which is which changes how you assess the risk, because SMBv3 flaws like SMBGhost are 445-only: SMBv3 is direct-hosted and never touches the NetBIOS transport. The table below maps the full NetBIOS and SMB port group.

Why is port 445 a vulnerability?

Port 445 is a vulnerability when it is reachable from an untrusted network, because it exposes SMB, a credential-carrying protocol with a long history of wormable remote code execution flaws, straight to anyone who can connect. The risk splits into three attack patterns your assessment should treat separately.

Remote code execution and wormable exploits

An unpatched SMB service on port 445 lets a remote attacker run code on the host: EternalBlue (SMBv1) and SMBGhost (SMBv3.1.1) both allow remote code execution (RCE) and both are wormable. Wormable means the exploit spreads itself from host to host with no user action, and an attacker who reaches an unpatched SMB service can run code as SYSTEM and pivot immediately. The 2017 WannaCry and NotPetya outbreaks both used EternalBlue and spread across networks within days. A single unpatched SMB host is enough to seed a network-wide ransomware event, which is why our scanners escalate an exposed 445 to critical on sight.

Lateral movement, credential theft, and NTLM relay

Port 445 enables lateral movement: once an attacker holds any valid hash or password, SMB lets them execute commands, dump credentials, and enumerate Active Directory on other hosts, using tools like psexec, smbexec, and secretsdump. SMB also carries NTLM (New Technology LAN Manager) authentication, which attackers abuse through relay and reflection. Microsoft has deprecated NTLM and is phasing it out, but it still runs on most networks today, so relay attacks remain practical wherever SMB signing is not enforced. Some recent NTLM flaws are local rather than remote: CVE-2026-24294, fixed in Microsoft’s March 2026 updates, is a local privilege escalation in Windows SMB Server. It needs a foothold on the host first, so it matters after a breach, not as an internet-exposure risk.

Internet-exposed SMB is an immediate critical finding

Any internet-facing port 445 is a critical finding, and you should block it at the network boundary whether or not the host is patched. It is one of the most consistently weaponized exposures, and CISA’s SMB security best practices recommend blocking SMB at the network boundary: TCP 445, plus UDP 137 and 138 and TCP 139. Even a patched host stays a target, because attackers scan for 445 constantly and probe every responder. Shadowserver counted 675,172 IP addresses with SMB reachable in the week of 12 to 18 October 2026, down 15.7% from a year earlier. Do not rely on moving SMB to a non-standard port either. Internet-wide scanners identify a service by how it answers, not by its port number: Censys has described checking 17 protocols on each of the 2,000+ ports it scans, and reported that 66% of the services it detects run on non-standard ports (Censys, 2021). If you run a lean IT team already fighting alert fatigue, treat any external 445 as a drop-everything finding rather than a backlog ticket. You can see where it sits against your other exposures in a full open ports security risk assessment.

Which port 445 situation are you in?

Find your setup in the table to see how urgent port 445 is for you and what to do first. The same open port means very different things on a home router, a cloud server, and an internal file server.

Port 445 vulnerability CVEs you must know

Patch EternalBlue (CVE-2017-0144) and SMBGhost (CVE-2020-0796) first, then any other SMB CVE that appears in the CISA Known Exploited Vulnerabilities catalog. The table lists each CVE (Common Vulnerabilities and Exposures) with its current CVSS v3.1 base score from the National Vulnerability Database (NVD), and the notes below add the detail that matters for remediation. Five of them are in the CISA Known Exploited Vulnerabilities catalog: CVE-2017-0144, CVE-2020-0796, CVE-2008-4250, CVE-2017-7494 and CVE-2025-24054. Treat any of those as top priority, because attackers are exploiting them now.

EternalBlue and SMBGhost, the two that define the risk

EternalBlue is a wormable SMBv1 remote code execution flaw, and SMBGhost is a pre-authentication wormable RCE in SMBv3.1.1 that scores CVSS 10.0. EternalBlue, tracked as CVE-2017-0144 and patched in Microsoft bulletin MS17-010, remains the reference example of a wormable SMB exploit. SMBGhost, tracked as CVE-2020-0796, is worse in one respect: it hits SMBv3.1.1 before authentication and hits SMBv3.1.1 before authentication, exploiting a heap-based buffer overflow in the compression handler. McAfee researchers traced the bug to an oversized OriginalCompressedSegmentSize value copied into a fixed buffer. SMBleed (CVE-2020-1206) sits in the same code path and chains with SMBGhost to turn a crash into reliable code execution. Patch all three, and disable SMBv1 entirely.

SambaCry and Samba on Linux and NAS devices

Samba, the SMB implementation for Linux servers and NAS devices, is affected too: SambaCry (CVE-2017-7494) allows remote code execution on Samba servers over port 445. Samba listens on 445 just like Windows, so this is not only a Windows concern. SambaCry affects Samba from 3.5.0 until the 4.6.4, 4.5.10 and 4.4.14 releases. It lets an attacker upload a shared library to a writable share and make the server run it, which earned a CVSS score of 9.8 and a place in the CISA catalog. Check your Samba version with smbd --version, update to a fixed release, and remove write access from any share that does not need it. Home and office NAS devices that expose 445 to the internet are a common way this exposure appears.

How to check if port 445 is open and vulnerable

Check whether port 445 is open by running netstat on the host, then scanning it from outside your network with Nmap’s SMB scripts. Verify from both inside and outside, because an internal check alone will not tell you what the internet sees. Run these checks before you assume 445 is safe.

• Run a local check on Windows with netstat -an | find ":445", or on Linux with sudo netstat -tulnp | grep ":445", to see whether a service is listening.
• Scan the host externally with Nmap and the SMB scripts: nmap -p445 -sV --script "smb-protocols,smb-security-mode,smb-vuln-ms17-010" <target>. The smb-protocols script flags SMBv1, and smb-security-mode tells you whether signing is required, which matters for NTLM relay.
• Confirm exposure from an external network, not from inside, since an internal scan can report a misleading result. The Nmap smb-vuln-ms17-010 script checks directly for EternalBlue.

Public exploit tooling exists for these flaws, which is one more reason to treat an open 445 as urgent. The Metasploit module exploit/windows/smb/ms17_010_eternalblue targets SMBv1 over port 445, and its documentation warns it can crash or reboot the target. Use it only on systems you are authorised to test.

For continuous coverage across every host, ScanTitan’s network vulnerability scanner tests for open 445 and the SMB CVEs above, then attaches the evidence to each finding. Broader context lives in our guide to network vulnerability scanning.

How to close port 445

Close port 445 by blocking inbound TCP 445 with a firewall rule on the host, at the perimeter, and in every cloud security group. SMB almost never has a legitimate reason to face an untrusted network. Pick the control that matches your platform.

• Block it on Windows with a firewall rule: New-NetFirewallRule -DisplayName "Block SMB 445" -Direction Inbound -Protocol TCP -LocalPort 445 -Action Block.
• Deny it on Linux with ufw by running sudo ufw deny 445/tcp, or with firewalld by running sudo firewall-cmd --permanent --remove-port=445/tcp followed by sudo firewall-cmd --reload.
• Drop it with iptables where you manage rules directly: sudo iptables -A INPUT -p tcp --dport 445 -j DROP.
• Filter it at the perimeter firewall, the cloud security group, and any load balancer, so 445 is unreachable from outside your trusted network even if a host rule fails.
• Deny outbound TCP 445 to the internet as well, not just inbound, so a compromised or coerced host cannot leak an SMB session or NTLM credentials to an attacker-controlled server.

What depends on port 445 before you block it

Blocking inbound 445 at your internet edge does not affect traffic inside your network, so the internal services below keep working. The ones to check are the services that use 445 internally, because a host-level rule that blocks everything would break them.

• File shares and mapped network drives.
• Shared printers hosted on Windows machines.
• Domain controllers, which serve Group Policy and logon scripts from the SYSVOL and NETLOGON shares over SMB.
• Backup jobs that write to an SMB share.
• Remote administration tools that run commands over SMB.

How to open port 445 safely, and when you should not

Open port 445 only to specific trusted source ranges or over a VPN, never to the whole internet. An administrator sometimes genuinely needs 445 reachable, for a file server or a backup target, and the goal is to open it for the right people without handing it to the internet.

• Restrict the Windows rule to trusted source ranges: New-NetFirewallRule -DisplayName "Allow SMB 445 internal" -Direction Inbound -Protocol TCP -LocalPort 445 -Action Allow -RemoteAddress 10.0.0.0/8.
• Keep it off the public internet entirely, since exposing 445 to 0.0.0.0/0 is the kind of misconfiguration that worms like WannaCry depend on.
• Prefer a VPN (Virtual Private Network) for remote file access, so SMB rides an encrypted tunnel instead of a raw internet-facing port.

How to fix the port 445 vulnerability: hardening checklist

Fix the port 445 vulnerability by blocking 445 at the perimeter, disabling SMBv1, requiring SMBv3 with signing, patching known SMB CVEs, and restricting share access. That means shrinking the SMB attack surface and keeping the service patched, not just toggling the firewall once. Work through these controls on every host that runs SMB.

1. Disable SMBv1 completely with Set-SmbServerConfiguration -EnableSMB1Protocol $false, following the Microsoft guidance on detecting and disabling SMBv1. SMBv1 exposes the EternalBlue family directly.
2. Require SMBv3 with encryption so file traffic is protected in transit and older, weaker dialects are refused.
3. Enforce SMB signing to defeat relay attacks: Set-SmbServerConfiguration -RequireSecuritySignature $true.
4. Patch MS17-010 and SMBGhost promptly, and prioritize any SMB CVE that lands in the CISA catalog, using the approach in our guide to prioritizing vulnerability remediation.
5. Turn off SMBv3 compression on affected Windows builds by setting the DisableCompression registry value, the SMBGhost workaround Rapid7 recommends until you can apply the patch.
6. Restrict share permissions with least-privilege access control lists (ACLs), and remove anonymous or null-session access.
7. Segment the network so a single compromised host cannot reach every SMB service, and route remote access through a VPN rather than an open port.
8. Monitor SMB traffic with a SIEM (Security Information and Event Management) platform and an IDS (Intrusion Detection System), and set up continuous vulnerability scanning so a newly opened 445 gets caught fast.

Compliance, third-party exposure, and monitoring

An exposed port 445 is a recurring audit and cyber-insurance finding, so close it, keep the evidence, and monitor for it to return. It is not only a technical risk, and closing it is cheaper than explaining it. Several frameworks restrict internet-facing file sharing directly, and assessors check for open 445 as a matter of routine.

Auditors increasingly want evidence across both layers, so scan your public-facing website alongside the network assessment and keep both reports.

• Map port 445 findings to PCI DSS external scanning requirements, and to ISO 27001 and NIST 800-53 controls that auditors flag when SMB reaches the public internet.
• Address NIS2 obligations for essential and important entities, covered in our guide to vulnerability scanning for NIS2 compliance.
• Extend the check to vendors, since a partner with an exposed 445 becomes your incident, using tools like ScanTitan’s IP vulnerability scanner to test external ranges.
• Watch for new exposures continuously through network ports and exposure monitoring, because port posture drifts every time someone provisions a host.

Frequently asked questions