CVE-2023-24880: Windows SmartScreen security feature bypass via incorrect authorization

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is in CISA KEV with known ransomware use and a very high EPSS score, though the CVSS base score is only medium and exploitation requires user interaction.

What it is

CVE-2023-24880 is a security feature bypass in Microsoft Windows SmartScreen, rooted in incorrect authorization (CWE-863). Because SmartScreen is the mechanism that warns users before running untrusted files, bypassing it removes a key defense against malicious downloads and attachments. The record's description is thin and does not explain the specific mechanism of the bypass.

Impact

An attacker can get a malicious file past SmartScreen's warning and reputation checks, weakening the user's last line of defense before execution. The CVSS impact is limited to low integrity and availability effects, but the real-world value is in evading a protective control.

Attack surface

The vector is local (AV:L) with user interaction required (UI:R) and no privileges required (PR:N), meaning the attacker must get the victim to open or run a crafted file. No authentication is needed; success depends on convincing the user to interact with the payload.

Exploitation

It is listed in CISA's Known Exploited Vulnerabilities catalog with a 2023-04-04 remediation due date and is flagged for known ransomware campaign use. EPSS is very high at 0.78152 (99.55th percentile), indicating substantial observed exploitation activity.

What to do

• Apply the Microsoft updates referenced in the MSRC advisory for all affected Windows 10, Windows 11, and Windows Server versions.
• Prioritize patching per CISA KEV guidance, treating this as an actively exploited flaw with a 2023-04-04 due date.
• Enforce Mark-of-the-Web and SmartScreen settings via policy so downloaded files retain reputation checks.
• Restrict execution of files from untrusted sources using application control or blocklists where feasible.
• Educate users that opening unexpected attachments or downloads remains the trigger for this bypass.

Detection

• Monitor for processes executing files that lack or have stripped Mark-of-the-Web, especially from email and browser download paths.
• Alert on SmartScreen or Defender SmartScreen events indicating suppressed or bypassed warnings.
• Correlate file execution events with known ransomware precursor behavior on endpoints running unpatched Windows builds.
• Review endpoint telemetry for unusual child processes spawned from user download or temp directories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.