Microsoft issued an advisory warning of an unpatched, wormable critical Remote Code Execution (RCE) vulnerability in Microsoft SMBv3 (Microsoft Server Message Block 3.1.10) network communication protocol. This indicates an attack attempt to exploit a Buffer Overflow Vulnerability in Microsoft SMB Servers.
The vulnerability is due to an error when the vulnerable software handles a maliciously crafted compressed data packet. A remote, unauthenticated attacker can exploit this to execute arbitrary code within the context of the application.

#Affected_Products:
Windows 10 Version 1903 for 32-bit Systems
Windows 10 Version 1903 for x64-based Systems
Windows 10 Version 1903 for ARM64-based Systems
Windows Server, version 1903 (Server Core installation)
Windows 10 Version 1909 for 32-bit Systems
Windows 10 Version 1909 for x64-based Systems
Windows 10 Version 1909 for ARM64-based Systems
Windows Server, version 1909 (Server Core installation)

#Impact
System Compromise: Remote attackers can gain control of vulnerable systems.

#Recommended_Actions

Apply the patch for this vulnerability as soon as it becomes available.

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/adv200005

Workarounds:

Disable SMBv3 compression
Block TCP port 445

#Reference

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/adv200005

https://support.microsoft.com/en-us/help/3185535/preventing-smb-traffic-from-lateral- connections

https://fortiguard.com/encyclopedia/ips/48773