---
title: SMBGhost: Detailed Information and Ivanti Neurons for RBVM System Filter
slug: rbvm-help/smbghost-detailed-information-and-ivanti-neurons-for-rbvm-system-filter
createdAt: 2026-10-26T13:51:24.777Z
---

**Summary**: Additional information regarding the SMBGhost vulnerability and how to use the SMBGhost filter in Ivanti Neurons RBVM/ASPM/VULN KB.

On March 11, 2020 Microsoft published [ADV200005](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200005), a security advisory about a critical vulnerability (CVE-2020-0796, also known as SMBGhost) affecting versions of Windows 10 and Windows Server 2016 released since May 2019. Typically, advisories of this sort are released along with software patches to remediate the vulnerability. In this case, Microsoft did not release the corresponding updates resulting in an "official" zero-day vulnerability.

SMBGhost is a pre-authentication memory corruption issue affecting SMB 3.1.1 servers and clients. If successfully weaponized this vulnerability could be used for anonymous remote takeover of Windows hosts similar to what is achieved by the ETERNALBLUE exploit used by the WannaCry ransomware.

Information about this vulnerability was leaked to the public ahead of that advisory through a Cisco Talos "Patch Tuesday" analysis including information about this vulnerability; Cisco Talos later removed all information about this vulnerability from that analysis. This removal of information prompted the twitter account "[@MalwrHunterTeam](https://twitter.com/malwrhunterteam)" to nickname the vulnerability "SMBGhost": "[it not exists](https://twitter.com/malwrhunterteam/status/1237480108568477697)."

Microsoft released [KB4551762](https://support.microsoft.com/en-us/help/4551762/windows-10-update-kb4551762) as an out-of-band emergency patch on Thursday, March 12, 2020 to remediate the vulnerability.

RiskSense analysts expect this vulnerability to have less widespread impact than the MS17-010 vulnerabilities associated with the WannaCry malware due to the relatively brief availability of vulnerable versions. Weaponization of the vulnerability may be limited by secondary protection mechanisms such as KASLR used in the affected, modern versions of Windows 10 and Windows Server 2016. Nevertheless, the vulnerability is serious and RiskSense recommends applying the official patches for this vulnerability as soon as possible.

\---

By using Ivanti Neurons RBVM/ASPM/VULN KB’s SMBGhost system filter, you can narrow down which of your hosts are vulnerable to SMBGhost.

To access this system filter in Neurons RBVM/ASPM/VULN KB, navigate to either the **Manage > Hosts** or **Manage > Host Findings **page. For this example, we will show you how to apply the SMBGhost system filter to the **Manage > Hosts** page.

::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/JI329-fjaF0IDm6P6h7x8_deleting-a-host.png" alt="Navigation - Manage - Hosts" position="flex-start" size="60" width="417" height="190" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Deleting a Host.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Deleting a Host.png" showCaption="false"}

To apply the SMBGhost system filter, click the system filters (:inlineImage[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/KiO9jbDXuyR8g5yHbgMt4_attack-vectors-rs-filter.png" alt="System Filter - Small-1" caption size="10" width="25" height="25"}) button.

::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/I6k8d5280k-Wkiut1DNWM_smbghost-detailed-information.png" alt="SMBGhost Filter - System Filter Button Location" position="flex-start" size="74" width="517" height="222" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/SMBGhost Detailed Information.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/SMBGhost Detailed Information.png" showCaption="false"}

In the system filters menu, click the **SMBGhost** filter.

::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/lPABHsT_0z1WpZOLp1UYn_smbghost-detailed-information1.png" alt="SMBGhost Filter - SMBGhost Filter Location" position="flex-start" size="44" width="306" height="345" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/SMBGhost Detailed Information_1.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/SMBGhost Detailed Information_1.png" showCaption="false"}

The Hosts page is now filtered for hosts vulnerable to SMBGhost.