CVE-2022-44698
Microsoft Defender SmartScreen Security Feature Bypass Vulnerability
Description
CVE-2022-44698 is a security feature bypass vulnerability in Windows SmartScreen that allows an attacker to circumvent the Mark of the Web (MOTW) protection. By crafting a malicious file, an attacker can evade SmartScreen warnings that normally alert users when opening files downloaded from the internet, making social engineering attacks more effective. Rated Medium severity with a CVSS score of 5.4, CVE-2022-44698 has nonetheless been actively exploited in the wild and is associated with ransomware campaigns. CISA added it to its Known Exploited Vulnerabilities catalog with a remediation deadline of January 3, 2023, and its EPSS score of 0.66 (98th percentile) indicates a very high probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:LOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1607 | < 10.0.14393.5582 |
| microsoft | windows 10 1809 | < 10.0.17763.3770 |
| microsoft | windows 10 20h2 | < 10.0.19042.2364 |
| microsoft | windows 10 21h1 | < 10.0.19043.2364 |
| microsoft | windows 10 21h2 | < 10.0.19044.2364 |
| microsoft | windows 10 22h2 | < 10.0.19045.2364 |
| microsoft | windows 11 21h2 | < 10.0.22000.1335 |
| microsoft | windows server 2016 | < 10.0.14393.5582 |
| microsoft | windows server 2019 | < 10.0.17763.3770 |
| microsoft | windows server 2022 | < 10.0.20348.1366 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44698(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-44698(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2022-44698 by the NVD. The vulnerability is classified as a security feature bypass, where Windows SmartScreen fails to properly apply Mark of the Web protections to certain crafted files. This allows attackers to deliver malicious content that bypasses the trust verification mechanisms built into Windows.
Impact Analysis
Confidentiality Impact: None directly — the SmartScreen bypass itself does not expose data, but it enables follow-on attacks that can lead to full data theft. Integrity Impact: Low — the vulnerability undermines the integrity of Windows' security feature by allowing malicious files to bypass SmartScreen warnings, enabling the execution of untrusted code without user awareness. Availability Impact: Low — while the bypass itself has limited availability impact, it serves as a gateway for payloads that can disrupt system operations. Scope: Unchanged — the vulnerability is confined to the SmartScreen security mechanism within the user's Windows session. Attack Prerequisites: Exploitation requires network access and user interaction — the victim must open a crafted file delivered via email, web download, or other means. No authentication is required by the attacker. Chained Risk: The true danger of CVE-2022-44698 lies in its use as part of attack chains. By bypassing SmartScreen, attackers remove a critical user-facing warning, significantly increasing the success rate of phishing campaigns, malware delivery, and ransomware deployment.
Exploit Maturity
Active Exploitation: Microsoft confirmed that CVE-2022-44698 has been actively exploited in the wild. Threat actors used crafted files, including JavaScript files and other scripting formats, to bypass SmartScreen protections and deliver malware. KEV Catalog Status: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of January 3, 2023. EPSS Score: The EPSS score of 0.66 (98th percentile) reflects a very high probability of exploitation, consistent with its confirmed active use in attacks. Ransomware Association: CVE-2022-44698 has a confirmed association with ransomware campaigns. By bypassing SmartScreen, attackers can deliver ransomware payloads without triggering the security warning that would normally prompt users to stop execution. Attack Campaigns: This vulnerability has been observed in distribution campaigns for Magniber ransomware and other malware families, where threat actors crafted JavaScript files or MSI installers that evaded SmartScreen checks.
Remediation
- Apply the December 2022 Patch Tuesday security update from Microsoft that addresses CVE-2022-44698 on all affected Windows systems.
- Prioritize patching for Windows 10 (all supported versions), Windows 11 21H2, Windows Server 2016, Windows Server 2019, and Windows Server 2022.
- If immediate patching is not possible, implement additional email and web filtering controls to block suspicious file types commonly used in SmartScreen bypass attacks (e.g., .js, .msi, .iso files from untrusted sources).
- Educate users to exercise caution when opening files from unknown sources, even if SmartScreen warnings are not displayed.
- Ensure endpoint detection and response (EDR) solutions are active and up to date to detect malicious activity that may follow a SmartScreen bypass.
- Review Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44698 for specific patch details and deployment guidance.
- Verify compliance with CISA's remediation deadline if your organization is subject to Binding Operational Directive 22-01.
Technical Details
Vulnerability Mechanism: CVE-2022-44698 is a security feature bypass in Windows SmartScreen. SmartScreen uses the Mark of the Web (MOTW) — an NTFS alternate data stream applied to files downloaded from the internet — to determine whether to display a security warning when a user opens the file. The vulnerability allows an attacker to craft files that do not properly receive or retain the MOTW designation, causing SmartScreen to skip its security check. CVSS Vector Analysis: The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) with a score of 5.4 reflects the bypass nature of the vulnerability. It requires user interaction (opening the crafted file) and the direct impact on confidentiality is none, since the bypass itself does not expose data. The integrity and availability impacts are rated Low because the vulnerability merely disables a security warning rather than directly compromising the system. Exploitation Pathway: An attacker creates a malicious file — such as a JavaScript file (.js), MSI installer, or a file within a container format like ISO — that is specifically crafted to prevent or strip the Mark of the Web. The file is delivered to the victim via phishing email, malicious website, or other distribution vector. When the victim opens the file, Windows SmartScreen does not display the expected security warning because the MOTW is absent or improperly processed. This allows the malicious payload to execute without the additional user consent normally required. Affected Systems: Windows 10 versions 1607, 1809, 20H2, 21H1, 21H2, and 22H2; Windows 11 version 21H2; Windows Server 2016, 2019, and 2022 are all affected by this vulnerability.
Frequently Asked Questions
What is CVE-2022-44698?
CVE-2022-44698 is a security feature bypass vulnerability in Windows SmartScreen that allows attackers to create files that evade the Mark of the Web (MOTW) protection. This means users do not see the usual security warning when opening potentially malicious files downloaded from the internet.
Why is a Medium-severity vulnerability in the KEV catalog?
Despite its CVSS score of 5.4, CVE-2022-44698 is actively exploited in the wild and is used as part of ransomware attack chains. SmartScreen bypasses are highly valuable to attackers because they remove a key defensive barrier, making phishing and malware delivery significantly more effective.
Is CVE-2022-44698 linked to ransomware?
Yes, this vulnerability has been associated with ransomware campaigns, including Magniber ransomware distribution. Attackers use the SmartScreen bypass to deliver ransomware payloads that execute without triggering security warnings.
How do I fix CVE-2022-44698?
Apply the December 2022 Patch Tuesday update from Microsoft. This update restores proper SmartScreen behavior and ensures that the Mark of the Web is correctly applied and evaluated for downloaded files.
What file types are used to exploit this vulnerability?
Attackers have used JavaScript files (.js), MSI installers, and container formats like ISO files that can strip or prevent the Mark of the Web from being applied, allowing embedded payloads to bypass SmartScreen checks.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.