SMB port security guide: Port 139 and port 445 explained

Server Message Block (SMB) has moved data between Windows systems for four decades. It's still one of the most exposed protocols on enterprise networks today. Port 445 and its legacy counterpart, port 139, carry the traffic behind everyday file and printer sharing. Attackers know it. Both ports sit near the top of every scan they run against an exposed network.

Microsoft has responded by changing the defaults rather than relying on administrators to catch every gap. Windows 11, version 24H2, and Windows Server 2025 now require SMB signing out of the box.

CISA also added a new SMB privilege escalation flaw, CVE-2025-33073, to its Known Exploited Vulnerabilities catalog in October 2025. That's why port 139 and port 445 still need continuous monitoring, even after decades of running quietly in the background.

What is an SMB port?

Server Message Block (SMB) is a network protocol that governs file and resource sharing between computers on a network. SMB runs primarily over TCP port 445 and enables shared access to files, printers, and serial ports across connected devices.

Beyond file sharing, SMB supports two additional communication mechanisms: mail slots, which handle one-way interprocess messages, and named pipes, which allow two processes to exchange data on the same machine or across a network.

Windows systems have relied on SMB since the 1980s, and it’s still the default file-sharing protocol in most Windows environments today.

Port 139 vs. port 445: What is the difference?

SMB requires an open network port to function, and it uses either port 139 or port 445, depending on the Windows version involved.

Port 139

Port 139 was the original SMB port, running as an application-layer protocol over NetBIOS on local Windows networks. Windows 2000 introduced port 445 as a replacement, and most modern environments have phased out port 139 in favor of it.

Port 445

Port 445 runs SMB directly over TCP/IP, without a NetBIOS dependency. This allows SMB traffic to traverse multiple networks, including the internet, making port 445 the preferred choice in nearly every current Windows deployment.

Why this matters

If port 139 is open anywhere on your network, you're carrying legacy attack surface you probably don't need. NetBIOS-based traffic has no signing or encryption backstop of its own, which is exactly what let EternalBlue-class exploits spread unchecked in attacks like WannaCry.

Port 445 is more defensible, but only if SMB signing is enabled; otherwise, it's exposed to the same relay and privilege-escalation techniques behind CVE-2025-33073.

You can prevent this by blocking port 139 at the network edge, restricting port 445 to trusted segments, and enforcing SMB signing everywhere it's supported. Do that, and you've closed the two paths most SMB attacks still rely on.

How does the SMB protocol work?

SMB operates as a request-response protocol built on a client-server model, and a typical session follows four steps:

1. Negotiation: The client and server agree on the SMB dialect to use for the session.
2. Session setup: The client authenticates with the server using its credentials.
3. Tree connect: The client requests access to a specific shared resource, such as a folder or printer.
4. File access: The client sends read, write, or print requests, and the server responds to each one directly.

This same negotiation and request-response mechanism supports mail slot and named pipe communication in addition to standard file and printer sharing. IBM designed SMB in 1983 for DOS file access over local networks. Microsoft merged the protocol with its LAN Manager product in 1990.

The protocol matured through several major revisions since then. These include the Common Internet File System (CIFS) dialect and the performance and security improvements in SMB2 and SMB3.

Each revision addressed a specific weakness in the previous version, and SMB3 introduced the encryption capabilities that current Windows versions rely on by default.

SMB protocol dialects

SMB implementations vary across environments, and several dialects have emerged to support different platforms and use cases.

• CIFS (Common Internet File System): A Microsoft dialect introduced with Windows 95 that lets clients connect to remote file and printer shares as though they were local resources.
• Samba: An open source dialect that lets Linux and Unix systems communicate with Windows devices over SMB.
• NQ: A portable SMB implementation from Visuality Systems, commonly found on non-Windows devices such as printers and network devices.
• Tuxera SMB and MoSMB: Proprietary implementations built for specific use cases, including embedded systems and enterprise file sharing with advanced authentication.

These dialects share the same underlying SMB architecture, and organizations running mixed Windows, Linux, and embedded environments frequently rely on more than one.

Security risks of open SMB ports

SMB ports carry legitimate file and print traffic, and open ports also create a path that attackers actively probe. Exposed or misconfigured SMB ports have enabled some of the most damaging network worms and privilege escalation exploits of the past decade, and new vulnerabilities continue to surface.

Left unmanaged, open SMB ports expose networks to wormable propagation, man-in-the-middle interception, and NetBIOS spoofing. These risks sit alongside earlier flaws such as the SMBv3 vulnerability disclosed in past Patch Tuesday cycles, and the pattern makes clear that SMB requires ongoing patch management as a standing practice.

Case study: WannaCry (2017)

WannaCry (2017) remains the clearest historical example of what an unpatched SMB vulnerability can do. The ransomware exploited a flaw in an outdated version of SMBv1 via the EternalBlue exploit over TCP port 445, installing itself on a target machine, encrypting files, and demanding a ransom.

Infected systems then scanned the network via SMB for other vulnerable machines and self-propagated, requiring no user action. The damage traces straight back to unpatched systems running outdated SMB versions. That's why any ransomware prevention strategy should treat SMB version and patch management as a baseline control.

CVE-2025-33073: Windows SMB client privilege escalation

Microsoft disclosed CVE-2025-33073 in June 2025. The improper access control flaw in the Windows SMB client allows an authenticated attacker to escalate privileges to SYSTEM by abusing how SMB handles NTLM authentication when signing isn’t enforced.

The vulnerability carries a CVSS score of 8.8, and CISA added it to its Known Exploited Vulnerabilities catalog in October 2025 after confirming active exploitation. The flaw affects currently supported versions of Windows 10, Windows 11, and Windows Server, which makes SMB signing enforcement a priority rather than an optional hardening step.

CVE-2025-37899: Linux ksmbd zero-day

CVE-2025-37899 affects ksmbd, the in-kernel SMB3 server built into the Linux kernel. The flaw is a use-after-free vulnerability in how ksmbd handles the SMB2 LOGOFF command, and it matters for any organization running mixed Windows and Linux file-sharing environments, including Samba and ksmbd deployments.

Linux-based SMB implementations require the same patch discipline as Windows systems, since attackers don’t limit SMB targeting to a single operating system.

How to secure port 139 and port 445

Closing unnecessary SMB exposure and hardening the ports left open takes a mix of network controls and configuration changes. It fits within a broader network security program; it doesn't stand alone.

Enable firewall and endpoint protection

A firewall or endpoint protection platform blocks connection attempts from unrecognized or known malicious IP addresses before they reach an SMB service. Most endpoint protection platforms also maintain blocklists that update automatically as new malicious infrastructure is identified.

Utilize VPNs

A VPN encrypts SMB traffic in transit, preventing attackers positioned along the network path from reading or tampering with file-sharing traffic between systems.

Create VLANs

Segmenting internal traffic into VLANs limits how far an attacker can move after compromising a single device, since SMB traffic stays contained within its assigned network segment.

Implement MAC address filtering

MAC address filtering restricts network access to a defined list of approved devices, preventing unrecognized systems from accessing SMB shares even when they connect to the same physical network.

Enforce SMB signing

Starting with Windows 11, version 24H2, and Windows Server 2025, Microsoft requires SMB signing by default. Windows 11 24H2 Enterprise, Pro, and Education editions require both outbound and inbound signing, while Windows Server 2025 requires outbound signing.

SMB signing prevents relay attacks and tampering by verifying that traffic hasn’t been altered in transit, thereby closing the exploitation path CVE-2025-33073 relies on.

Organizations still running older Windows versions should enable signing manually through Group Policy rather than waiting for a forced upgrade.

Disable NetBIOS over TCP/IP and SMBv1

SMBv1 ships disabled by default in Windows 10, Windows 11, and Windows Server 2019 and later. Don't assume it stays that way. Confirm it. To disable SMBv1 through PowerShell, run:

      Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol
      

To disable NetBIOS over TCP/IP on older systems through the interface, open Network and Dial-up Connections, right-click the active connection, and select Properties. Select Internet Protocol (TCP/IP), select Properties again, select Advanced, then select the WINS tab and choose Disable NetBIOS over TCP/IP.

Closing unnecessary ports and enforcing signing reduces attack surface at the network layer. Data behind an open SMB share still needs its own access review, since folder permissions accumulate over time regardless of how well the port itself is secured. A PowerShell script can audit and adjust file system ACLs directly, saving teams time that would otherwise be spent on manual management.

Keeping port 139 and port 445 secure over time

Port 139 and port 445 exist because file sharing remains a core function of nearly every Windows network, and that same function makes SMB a persistent target.

The protocol has matured considerably since its DOS origins, and current defaults, such as mandatory SMB signing in Windows 11 24H2 and Windows Server 2025, close gaps that had remained open for years. Consistent patching, signing enforcement, and network segmentation keep the ports themselves defensible.

Securing the port is only half the picture. The files and folders sitting behind an SMB share need their own visibility and governance, since permissions accumulate long after the original business reason for granting them has expired.

Request a demo to see how Netwrix can help you track file share activity, flag over-permissioned SMB shares, and simplify audit evidence collection.