CVE-2017-0021: Microsoft Windows 10

Critical severity, CVSS 9.0. EPSS: 1.7% chance of exploitation in the next 30 days.

Hyper-V in Microsoft Windows 10 1607 and Windows Server 2016 does not properly validate vSMB packet data, which allows attackers to execute arbitrary code on a target OS, aka "Hyper-V System Data Structure Vulnerability." This vulnerability is different from that described in CVE-2017-0095.

Affected products

• Microsoft Windows 10: version 1607 only
• Microsoft Windows Server 2016: any version

Published 2017-03-17. Last modified 2026-06-17.