Article

Cyber Essentials Plus: Windows SMB Version 1 (SMBv1) Detected

March 26, 2025

Introduction

With cyber threats constantly evolving, staying ahead of vulnerabilities is crucial. One significant, yet long-standing vulnerability relates to Windows Server Message Block Version 1 (SMBv1). This outdated protocol allows attackers to gain unauthorised access to systems, posing a serious risk to security. Cybercriminals can use this weakness to infiltrate your network, steal sensitive data, and disrupt operations. By addressing the SMBv1 vulnerability, you can safeguard your systems. In this article, we delve into the details of the SMBv1 vulnerability, advise why it matters, set out ways to fix the problem, and link it to one of the benefits of Cyber Essentials Plus testing.

Cyber Essentials Plus Testing

Cyber Essentials aims to prevent devices from being vulnerable to known security issues. The certification involves testing to determine whether an internet-based attacker can hack into systems using low-skill methods. It also checks devices to determine whether weaknesses exist. Qualified assessors use (specially designed) tools to carry out the Cyber Essentials Plus testing to identify and highlight these weaknesses. Findings can be extremely valuable for an organisation – an opportunity to identify and fix system weaknesses, before they can be exploited by bad actors.

Windows Server Message Block Version 1 (SMBv1) Explained

It’s an outdated and very insecure way for Windows to allow (network) files and folders to be shared across a network.

What an Attacker Can Do

Attackers can exploit the weakness to gain access to systems, execute malicious code, and spread malicious software across the network.

How it Works

SMBv1 enables file sharing across networks. However, due to its outdated nature, it has many security flaws that attackers can exploit to gain access to systems and execute malicious software. An example of this is the Wannacry vulnerability that caused such a devastating impact in 2017 – linked to the rapid spread of ransomware across many organisations, including the National Health Service in the UK.

Potential Impact

If SMBv1 is exploited, attackers can gain full control of your computer, potentially allowing them to access programs, view, change, steal, or delete data, and create new accounts.

Why it Matters

It’s a very serious security risk because it undermines the integrity and security of network communications. If malicious software is undetected, it can bypass security controls and cause harm to your device and data.

Severity

A CRITICAL severity ranking.
CVSSv3.1 Base score is 9.8
The vulnerability can be used to deploy malicious software.

Fix

A change to Windows using the Control Panel.

Warning – Before Making Changes

Before making changes, it’s recommended to test in a non-production environment, then roll out to a production environment, creating appropriate backups (in case of any need to revert).

Using Control Panel

Open Control Panel
Navigate to > Programs and Features > Turn Windows features on or off
Uncheck SMB 1.0/CIFS File Sharing Support
Click OK and restart

Further Fix Options

Change via PowerShell
Change via Windows Features

Verification

After disabling SMBv1, restart your computer to ensure the settings take effect.
A vulnerability management agent and/or credentialed scan should also be able to confirm remediation.

How We Help

At RB Consultancy Ltd we support organisations looking to implement controls and/or certify to Cyber Essentials and Cyber Essentials Plus requirements:

NCSC Assured Cyber Advisor – we help organisation understand and implement technical controls and provide detailed steps on how to resolve this vulnerability
As Cyber Essentials Plus Assessor – we assess organisations against the requirements and carry out vulnerability assessments
As Cyber Essentials Plus Certification Body – we issue organisations with certifications

Conclusion – How to fix Windows SMB Version 1

Cyber Essentials Plus testing identifies critical and high-risk vulnerabilities. By making changes via the Control Panel, you should be able to effectively mitigate the SMBv1 and enhance the security of your system. Regular updates and monitoring of the system for vulnerabilities are essential when maintaining a secure environment. There is always risk when making changes – follow best practice guidance on rolling out change (reverting if needed).

Information sources for SMBv1 vulnerability

Written by Remo Belisari, Managing Director of RB Consultancy Ltd, an experienced cyber security professional cyber advisor. Remo holds certifications relating to CISSP, ISSAP, ISO 27001, Cyber Essentials, IASME Cyber Assurance, and has many years experience in IT and cyber security. Remo has a history of supporting organisations from all over the world – including a Fortune 500 in USA and over 100 organisations across the UK. The views expressed in this blog are those of the author and do not necessarily reflect the views of RB Consultancy Ltd, its clients, partners, or affiliated organisations. The content is intended for general information only and should not be taken as legal advice.

Why I signed The Cyber Resilience Pledge and why it matters

July 16, 2026 No Comments

The Cyber Resilience Pledge is an initiative developed by DSIT and NCSC that asks organisations to commit to treating cyber risk as a business risk

Cyber Security Consultancy: Incident Response

June 26, 2026 No Comments

Incident response planning is the difference between a contained breach and a business-ending disaster. Using the 2014 Sony Pictures attack as a case study, we explain what incident response is, why it matters, and how to strengthen cyber resilience.

Benefits of Cyber Essentials Plus

June 26, 2026 No Comments

Cyber Essentials Plus certification goes beyond basic compliance by providing a technical security audit that actively tests your defences against real-world threats. Through hands-on vulnerability

Cyber Security Consultancy: Change Management

March 25, 2026 No Comments

Cyber Security Consultancy: Change Management A single change can bring multiple organisations to a standstill – the July 2024 CrowdStrike incident proved this, causing widespread outages across airlines, hospitals, and banks without any threat actors involved. Effective IT change management and business continuity planning require thorough testing, risk assessment, and rollback procedures before changes go […]

Cyber Security Consultancy: Physical and Environmental Protection

March 19, 2026 No Comments

Cyber Security Consultancy: Physical and Environmental Protection Cyber resilience goes beyond firewalls and passwords, physical security controls and environmental risk management are equally critical to protecting your organisation. Storm Dennis showed how flooding can destroy server rooms, backups, and operations in hours, highlighting why business continuity planning must account for real-world threats like fire, flood, […]

Cyber Security Risk Management: Supply Chain Security & Building Resilience

February 4, 2026 No Comments

Cyber Security Risk Management: Protecting Against Supply Chain Security Risks Effective cyber security risk management is not about eliminating every threat – it’s about understanding what could go wrong and putting appropriate measures in place to protect what matters most. The 2020 SolarWinds attack exposed critical supply chain security risks, with thousands of organisations compromised […]

Get started today

Ready to get certified and
reduce your cyber risk?

Book a free 30-minute discovery call with Remo. No sales pitch, no pressure — just a straightforward conversation about what you need and whether we are the right fit to help.

About RB Consultancy Ltd

Remo Belisari

Founder & Managing Director, RB Consultancy Ltd

Remo Belisari is a Chartered Cyber Security Professional with over a decade of experience advising organisations from start-ups to multinationals across the UK, Europe, Asia and the USA.

Through RB Consultancy Ltd he delivers high-quality, cost-effective and practical cyber security services that support compliance, strengthen resilience and enable business growth.

Remo holds the most respected certifications in the field and is personally involved in every client engagement, ensuring clear and valuable outcomes.