CVE-2023-36025
Microsoft Windows SmartScreen Security Feature Bypass Vulnerability
Description
CVE-2023-36025 is a high-severity security feature bypass vulnerability in Windows SmartScreen, a built-in protection mechanism that warns users before running potentially malicious files or visiting dangerous websites. By exploiting this flaw, an attacker can craft a malicious URL or file that bypasses SmartScreen prompts entirely, allowing malicious content to execute without the expected security warnings. CVE-2023-36025 affects a broad range of Microsoft Windows versions including Windows 10, Windows 11, and Windows Server editions. CISA has confirmed active exploitation by adding it to the Known Exploited Vulnerabilities catalog, and the EPSS score of 90.2% (99th percentile) indicates widespread exploitation activity in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | - |
| microsoft | windows 10 1607 | - |
| microsoft | windows 10 1809 | - |
| microsoft | windows 10 21h2 | - |
| microsoft | windows 10 22h2 | - |
| microsoft | windows 11 21h2 | - |
| microsoft | windows 11 22h2 | - |
| microsoft | windows 11 23h2 | - |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.6452 |
| microsoft | windows server 2019 | < 10.0.17763.5122 |
| microsoft | windows server 2022 | < 10.0.20348.2113 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36025(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36025(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2023-36025. The vulnerability is classified as a security feature bypass affecting Windows SmartScreen, which is responsible for analyzing URLs, downloads, and applications to protect users from phishing sites and malicious software.
Impact Analysis
CVE-2023-36025 carries a CVSS v3.1 base score of 8.8 (High severity), reflecting serious risk to organizations relying on SmartScreen as a security control. The vulnerability is remotely exploitable over the network with low attack complexity, meaning no special conditions are required to craft the bypass. Privileges Required (None): No authentication or elevated access is needed to deliver the malicious payload. User Interaction (Required): The victim must click a crafted URL or open a malicious file, but the bypass specifically eliminates the SmartScreen warning that would normally alert the user to the danger. Confidentiality (High): Once SmartScreen is bypassed, malicious payloads can execute with full access to the user's data, credentials, and files. Integrity (High): Attackers can install malware, modify system settings, and establish persistent access without triggering SmartScreen protections. Availability (High): Malicious payloads delivered through the bypass can disrupt system operations, deploy ransomware, or cause complete system compromise. The EPSS score of 90.2% places this vulnerability in the 99th percentile, indicating that exploitation is widespread and active. The combination of a high CVSS score, confirmed active exploitation, and the critical role SmartScreen plays in Windows security makes CVE-2023-36025 an urgent patching priority.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-36025 in the wild by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of December 5, 2023. The EPSS score of 90.2% (99th percentile) indicates widespread and active exploitation, placing it among the most targeted vulnerabilities in the current threat landscape. While the ransomware association is listed as unknown, SmartScreen bypass vulnerabilities are highly valued in malware delivery campaigns because they eliminate a critical layer of user-facing security. Attackers commonly use these bypasses to deliver infostealers, remote access trojans, and ransomware payloads that would otherwise be blocked or flagged by SmartScreen.
Remediation
- Apply Microsoft security updates immediately. Install the patches referenced in the Microsoft Security Response Center advisory for CVE-2023-36025 across all affected systems. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Patch all affected Windows versions, including Windows 10 (1507, 1607, 1809, 21H2, 22H2), Windows 11 (21H2, 22H2, 23H2), and Windows Server (2008, 2012, 2016, 2019, 2022). Prioritize internet-facing systems and user workstations that are most likely to encounter malicious URLs or files.
- Strengthen email and web gateway filtering. Deploy or update URL filtering and email security controls to block known malicious URLs and suspicious file types. Configure email gateways to quarantine messages containing URL shorteners, unusual file extensions (.url, .lnk), or embedded links to untrusted domains.
- Monitor for indicators of SmartScreen bypass exploitation. Review Windows Defender event logs and SmartScreen audit logs for unusual bypass events. Investigate any instances where potentially dangerous files were executed without SmartScreen prompts, particularly from internet-originated sources.
- Enforce application control policies using Windows Defender Application Control (WDAC) or AppLocker to restrict execution of unsigned or untrusted applications, providing an additional defense layer that operates independently of SmartScreen protection.
Technical Details
CVE-2023-36025 is a security feature bypass vulnerability in Windows SmartScreen, the component responsible for evaluating URLs, downloaded files, and applications against reputation databases and heuristic checks before allowing execution. The vulnerability allows an attacker to craft a specially formatted URL or Internet Shortcut file (.url) that, when clicked by a user, bypasses the SmartScreen check entirely. Attack Vector (Network): The attack is delivered remotely through phishing emails, malicious websites, or social engineering that entices the victim to click a crafted URL. Attack Complexity (Low): No special conditions or environmental prerequisites are needed — the crafted URL or file directly triggers the bypass without timing dependencies or additional exploitation steps. User Interaction (Required): The victim must click the malicious link or open the crafted file, but the bypass is specifically designed to suppress the SmartScreen warning that would normally alert the user to proceed with caution. This makes the required user interaction far more likely to succeed than in scenarios where SmartScreen is functioning properly. The bypass undermines a core trust boundary in Windows security architecture, as SmartScreen serves as the primary user-facing defense against malicious downloads and dangerous URLs. Once bypassed, subsequent payloads execute in the context of the user without any additional security prompts.
Frequently Asked Questions
Is CVE-2023-36025 being actively exploited?
Yes, CVE-2023-36025 is being actively exploited in the wild. CISA has confirmed this by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of December 5, 2023. The EPSS score of 90.2% (99th percentile) indicates widespread exploitation activity across the threat landscape.
What products are affected by CVE-2023-36025?
CVE-2023-36025 affects a broad range of Microsoft Windows versions including Windows 10 (1507, 1607, 1809, 21H2, 22H2), Windows 11 (21H2, 22H2, 23H2), and Windows Server editions (2008, 2012, 2016, 2019, 2022). All client and server deployments running these versions are vulnerable.
How do I fix CVE-2023-36025?
Apply the security patches from the Microsoft Security Response Center advisory for CVE-2023-36025. Ensure all affected Windows client and server versions are updated, prioritizing internet-facing systems and user workstations. Strengthen email and URL filtering as an additional defense layer, and consider deploying Windows Defender Application Control policies.
How severe is CVE-2023-36025?
CVE-2023-36025 is rated High severity with a CVSS v3.1 base score of 8.8. It can be exploited remotely without authentication, and while user interaction is required, the SmartScreen bypass makes users far more likely to fall victim. The EPSS score of 90.2% (99th percentile) and confirmed active exploitation place this among the most critical vulnerabilities to remediate.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.