CVE-2022-41049: Windows Mark of the Web security feature bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is in CISA KEV with confirmed in-the-wild exploitation, though the CVSS impact is only medium and requires user interaction.

What it is

Windows Mark of the Web (MOTW) fails to properly apply its security marking, allowing a crafted file to bypass the protections that MOTW normally enforces. Because MOTW gates warnings and other defenses for files from untrusted sources, a bypass weakens the user-facing trust boundary on affected Windows 10, Windows 11 and Windows Server versions. The record gives no root-cause detail beyond the CWE-noinfo entry, so the exact mechanism is not described.

Impact

An attacker can get a malicious file to be treated as trusted, so the usual MOTW warning and associated restrictions do not appear. The CVSS vector rates only low integrity and availability impact, so the direct effect is limited to defeating that protection rather than code execution on its own.

Attack surface

Reached over the network with no privileges required, but the vector requires user interaction (UI:R), meaning a victim must open or handle the crafted file. No authentication is needed; the attack depends on convincing a user to interact with the file.

Exploitation

CVE-2022-41049 is listed in CISA KEV with a due date of 2022-12-09, indicating known exploitation in the wild. EPSS is 0.02491 (83.8th percentile), and no ransomware campaign use is recorded.

What to do

• Apply the Microsoft updates referenced in the MSRC advisory for all affected Windows 10, Windows 11 and Windows Server versions.
• Prioritize patching per the CISA KEV due date of 2022-12-09.
• Restrict or block execution of files originating from untrusted sources (email, web downloads) through policy where feasible.
• Educate users not to open unexpected attachments or downloaded files, since exploitation requires user interaction.

Detection

• Monitor for files that execute without the expected MOTW marking or warning, focusing on email and browser download paths.
• Review endpoint telemetry for processes launched from user download or temp directories that lack MOTW attributes.
• Hunt for suspicious file types (archives, ISO, LNK, script) delivered via email or web that evade MOTW warnings.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.