CVE-2023-36025: Windows SmartScreen security feature bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw is confirmed exploited in the wild per CISA KEV and carries a very high EPSS score, though exploitation requires user interaction and no ransomware use is documented.

What it is

CVE-2023-36025 is a security feature bypass in Microsoft Windows SmartScreen, the component that warns users before running files downloaded from the internet. A successful bypass defeats that warning, so a user can be led into executing a malicious file that SmartScreen would otherwise have flagged. It affects a broad set of Windows client and server releases listed by the vendor.

Impact

An attacker can get a victim to run a malicious file without the SmartScreen warning that normally interrupts such execution, enabling code execution in the user's context. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

The vector is network-reachable with no privileges required, but user interaction is required (UI:R), consistent with a lure that convinces the victim to open or run a crafted file or link. No authentication is needed on the attacker's side.

Exploitation

CVE-2023-36025 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2023-11-14, remediation due 2023-12-05), and EPSS gives a 30-day exploitation probability of about 0.88 (99.8th percentile), indicating active exploitation in the wild. CISA records no known ransomware campaign use.

What to do

• Apply the Microsoft security update for CVE-2023-36025 to all affected Windows client and server versions; this is the vendor patch and the primary fix.
• Meet the CISA KEV remediation deadline of 2023-12-05, or discontinue use of affected products where mitigations are unavailable.
• Prioritize internet-facing and user-workstation systems, since exploitation depends on a user opening a crafted file or link.
• Enforce Mark-of-the-Web and SmartScreen settings through policy so downloaded files retain their warning state, and restrict execution of files from untrusted locations.
• Block or alert on known malicious delivery domains and file types at email and web gateways.

Detection

• Monitor for processes spawned from downloaded files in user download or temp directories, especially where SmartScreen or Mark-of-the-Web warnings were expected but absent.
• Review endpoint telemetry for SmartScreen or Defender SmartScreen bypass behavior and for unusual child processes of browsers, mail clients and archive tools.
• Hunt proxy, DNS and email logs for delivery of the lure files or URLs associated with this campaign, and correlate with endpoint execution events.
• Check patch state across the affected Windows 10, Windows 11 and Windows Server builds to confirm the update is installed.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.