Microsoft releases emergency patch for critical SMB vulnerability in Windows 10 and Windows Server

Earlier this week, Microsoft inadvertently released details of a critical vulnerability in the SMBv3 protocol in Windows 10 and Windows Server. While there was no fix available at the time, the company did provide suggestions about how to mitigate against attacks.

With the information out in the wild, Microsoft was under pressure to get a patch released to customers -- and now it has managed to produce such a fix. KB4551762 is an emergency patch for the CVE-2020-0796 vulnerability, and users are advised to install it as soon as possible.

See also:

• Microsoft leaks details of unpatched critical SMB vulnerability in Windows 10 and Windows Server
• Microsoft provides mitigation advice for critical vulnerability in SMBv3 protocol
• Microsoft releases .NET Core Uninstall Tool for Windows and Mac

The vulnerability was described as "wormable" by security firm Cisco Talos, hence Microsoft's decision to move quickly and release an out-of -schedule patch. The fix has been produced for Windows 10 versions 1903 and 1909, as well as Windows Server 2019 versions 1903 and 1909.

As this is a very specific update, Microsoft's description of it is very short and to the point:

Updates a Microsoft Server Message Block 3.1.1 protocol issue that provides shared access to files and printers.

The update is being delivered via Windows Update, but it can also be obtained from the Microsoft Update Catalog website or via WSUS. For systems where it is not possible to install the update immediately, it is a good idea to follow Microsoft's mitigation advice to disable SMBv3 compression and to block TCP port 445.

Image credit: Walter Cicchetti / Shutterstock