Port 445 Vulnerability: CVEs, Risks, and How to Close and Fix SMB Exposure

The port 445 vulnerability is the security risk of exposing Server Message Block (SMB) traffic, which runs over TCP port 445, to an untrusted network. Attackers target port 445 for wormable remote code execution, ransomware, and lateral movement, and it drove the 2017 WannaCry outbreak through the EternalBlue exploit. This guide covers the key CVEs, how to check whether port 445 is open, how to close it, and how to fix and harden SMB so your team removes the exposure before an attacker reaches it.

Short answer: Port 445 carries SMB (Server Message Block) file-sharing traffic. It becomes a vulnerability when exposed to untrusted networks, where attackers exploit CVEs such as EternalBlue (CVE-2017-0144) and SMBGhost (CVE-2020-0796) for wormable remote code execution and ransomware. Fix it by blocking 445 at the perimeter, disabling SMBv1, requiring SMBv3 with signing, and patching promptly. Never expose port 445 to the public internet.

What is port 445, and what is SMB?

Port 445 is the TCP port that carries Server Message Block (SMB), the protocol Windows uses to share files, printers, and other resources across a network. Microsoft moved SMB directly onto TCP port 445 with the release of Windows 2000, replacing the older arrangement that ran SMB over NetBIOS on ports 137 to 139. Every modern Windows file server, domain controller, and workstation listens on 445 by default, and that default is exactly the problem. SMB is essential inside a trusted network. The same port that lets your team share a folder also lets an attacker reach the file-sharing stack directly. Our explainer on what an open port is in cyber security sets the wider context.

What are ports 139 and 445 used for?

Ports 139 and 445 both carry SMB, but they belong to different generations of the protocol, and knowing which is which changes how you assess the risk. Port 139 is the NetBIOS Session Service, used by the legacy SMBv1 dialect. Port 445 is SMB running directly over TCP, the transport for SMBv2 and SMBv3. The critical detail for any assessment: SMBv3 flaws like SMBGhost are 445-only, because SMBv3 is direct-hosted and never touches the NetBIOS transport. The table below maps the full NetBIOS and SMB port group.

Why is port 445 a vulnerability?

Port 445 turns dangerous the moment it faces an untrusted network, because SMB exposes a rich, credential-carrying protocol straight to anyone who can reach it. The risk splits into three attack patterns your assessment should treat separately.

Remote code execution and wormable exploits

SMB has hosted some of the worst pre-authentication remote code execution (RCE) flaws in Windows history, and several were wormable, meaning the exploit spreads itself from host to host with no user action. An attacker who reaches an unpatched SMB service can run code as SYSTEM and pivot immediately. EternalBlue on SMBv1 and SMBGhost on SMBv3.1.1 both fit this pattern. According to SecPortal’s exposure research, the 2017 WannaCry and NotPetya outbreaks rode EternalBlue into hundreds of thousands of hosts within days. A single unpatched SMB host is enough to seed a network-wide ransomware event, which is why our scanners escalate an exposed 445 to critical on sight.

Lateral movement, credential theft, and NTLM relay

Once an attacker holds any valid hash or password, port 445 becomes their primary channel for moving through the network. They run tools like psexec, smbexec, and secretsdump over SMB to execute commands, dump credentials, and enumerate Active Directory. SMB also carries NTLM (New Technology LAN Manager) authentication, which attackers abuse through relay and reflection. Microsoft deprecated NTLM in 2024 and stated that some of its weaknesses sit in the design and cannot be patched. Recent flaws like the Windows NTLM reflection issue CVE-2026-24294, which already has a public proof of concept, bounce a privileged NTLM session back to SMB on port 445 to gain SYSTEM rights.

Internet-exposed SMB is an immediate critical finding

An internet-facing port 445 is one of the most consistently weaponized exposures in joint advisories from CISA, the FBI, the UK NCSC, and ENISA, per SecPortal’s summary of those advisories. Even a patched host stays a target, because attackers scan for 445 constantly and probe every responder. Do not rely on moving SMB to a non-standard port either. Censys researchers showed in 2026 that relocating SMB off 445 does not prevent discovery, since mass scanners fingerprint the protocol regardless of the number. If you run a lean IT team already fighting alert fatigue, treat any external 445 as a drop-everything finding rather than a backlog ticket. You can see where it sits against your other exposures in a full open ports security risk assessment.

Port 445 vulnerability CVEs you must know

Several named CVEs (Common Vulnerabilities and Exposures) define the port 445 threat, and your patch priority should follow this list. The table summarizes each one, and the notes below add the detail that matters for remediation. When any of these appears in the CISA Known Exploited Vulnerabilities catalog, treat it as top priority, because attackers are exploiting it now.

EternalBlue and SMBGhost, the two that define the risk

EternalBlue, tracked as CVE-2017-0144 and patched in Microsoft bulletin MS17-010, exploits a flaw in SMBv1 and remains the reference example of a wormable SMB exploit. SMBGhost, tracked as CVE-2020-0796, is worse in one respect: it scores CVSS 10.0 and hits SMBv3.1.1 before authentication, exploiting a heap-based buffer overflow in the compression handler. McAfee researchers traced the bug to an oversized OriginalCompressedSegmentSize value copied into a fixed buffer. SMBleed (CVE-2020-1206) sits in the same code path and chains with SMBGhost to turn a crash into reliable code execution. Patch all three, and disable SMBv1 entirely.

How to check if port 445 is open and vulnerable

Verify your exposure from both inside and outside the network, because an internal check alone will not tell you what the internet sees. Run these checks before you assume 445 is safe.

• Run a local check on Windows with netstat -an | find ":445", or on Linux with sudo netstat -tulnp | grep ":445", to see whether a service is listening.
• Scan the host externally with Nmap and the SMB scripts: nmap -p445 -sV --script "smb-protocols,smb-security-mode,smb-vuln-ms17-010" <target>. The smb-protocols script flags SMBv1, and smb-security-mode tells you whether signing is required, which matters for NTLM relay.
• Confirm exposure from an external network, not from inside, since an internal scan can report a misleading result. The Nmap smb-vuln-ms17-010 script checks directly for EternalBlue.

For continuous coverage across every host, ScanTitan’s network vulnerability scanner tests for open 445 and the SMB CVEs above, then attaches the evidence to each finding. Broader context lives in our guide to network vulnerability scanning.

How to close port 445

Close port 445 wherever it is not strictly needed, because SMB almost never has a legitimate reason to face an untrusted network. Pick the control that matches your platform.

• Block it on Windows with a firewall rule: New-NetFirewallRule -DisplayName "Block SMB 445" -Direction Inbound -Protocol TCP -LocalPort 445 -Action Block.
• Deny it on Linux with ufw by running sudo ufw deny 445/tcp, or with firewalld by running sudo firewall-cmd --permanent --remove-port=445/tcp followed by sudo firewall-cmd --reload.
• Drop it with iptables where you manage rules directly: sudo iptables -A INPUT -p tcp --dport 445 -j DROP.
• Filter it at the perimeter firewall, the cloud security group, and any load balancer, so 445 is unreachable from outside your trusted network even if a host rule fails.
• Deny outbound TCP 445 to the internet as well, not just inbound, so a compromised or coerced host cannot leak an SMB session or NTLM credentials to an attacker-controlled server.

How to open port 445 safely, and when you should not

Sometimes an administrator genuinely needs port 445 reachable, for a file server or a backup target, and the goal is to open it for the right people without handing it to the internet. Open it narrowly or not at all.

• Restrict the Windows rule to trusted source ranges: New-NetFirewallRule -DisplayName "Allow SMB 445 internal" -Direction Inbound -Protocol TCP -LocalPort 445 -Action Allow -RemoteAddress 10.0.0.0/8.
• Keep it off the public internet entirely, since exposing 445 to 0.0.0.0/0 is the exact misconfiguration behind most SMB ransomware incidents.
• Prefer a VPN (Virtual Private Network) for remote file access, so SMB rides an encrypted tunnel instead of a raw internet-facing port.

How to fix the port 445 vulnerability: hardening checklist

Fixing the port 445 vulnerability means shrinking the SMB attack surface and keeping the service patched, not just toggling the firewall once. Work through these controls on every host that runs SMB.

Compliance, third-party exposure, and monitoring

Exposed SMB is a recurring audit and cyber-insurance finding, not only a technical risk, and closing it is cheaper than explaining it. Several frameworks restrict internet-facing file sharing directly, and assessors check for open 445 as a matter of routine.

• Map port 445 findings to PCI DSS external scanning requirements, and to ISO 27001 and NIST 800-53 controls that auditors flag when SMB reaches the public internet.
• Address NIS2 obligations for essential and important entities, covered in our guide to vulnerability scanning for NIS2 compliance.
• Extend the check to vendors, since a partner with an exposed 445 becomes your incident, using tools like ScanTitan's IP vulnerability scanner to test external ranges.
• Watch for new exposures continuously through network ports and exposure monitoring, because port posture drifts every time someone provisions a host.

Frequently asked questions