CVE-2023-36584: Windows Mark of the Web security feature bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is confirmed exploited in the wild and listed in CISA KEV, though the CVSS impact is only medium and no ransomware use is documented.

What it is

CVE-2023-36584 is a security feature bypass in Microsoft Windows involving Mark of the Web (MOTW), the mechanism that flags files downloaded from the internet so Office and other applications can open them in Protected View or with reduced trust. A successful bypass weakens that warning layer, so a user can be tricked into opening a file that would normally be treated as untrusted. The record does not describe the specific bypass mechanism or the affected component beyond Windows itself.

Impact

An attacker gains the ability to have a malicious file treated as trusted, defeating the MOTW warning that normally prompts or restricts execution. The CVSS vector rates only low integrity and availability impact, so the direct effect is limited, but the bypass can serve as a step in a larger intrusion chain.

Attack surface

The vector is network-reachable with no privileges required, but user interaction is required, so the victim must open or handle a crafted file or content. No authentication is needed on the attacker's side; the attack depends on convincing a user to interact with the malicious artifact.

Exploitation

CVE-2023-36584 is listed in CISA's Known Exploited Vulnerabilities catalog, added 2023-11-16, which confirms exploitation in the wild. EPSS is 0.03055 (86.9th percentile), indicating elevated but not extreme predicted likelihood, and CISA records no known ransomware campaign use.

What to do

• Apply the Microsoft security update for CVE-2023-36584 on all affected Windows client and server versions listed in the advisory.
• Follow CISA KEV required action: apply vendor mitigations or discontinue use of the product if mitigations are unavailable.
• Enforce MOTW and Protected View settings in Office and block execution of files from untrusted internet zones where policy allows.
• Reduce reliance on MOTW alone by using application allowlisting and blocking macros and script execution from downloaded content.

Detection

• Monitor for files that lose or lack the Zone.Identifier alternate data stream after download, which can indicate a MOTW bypass.
• Alert on Office or script host processes spawning from user download or temp directories with untrusted-origin files.
• Review endpoint telemetry for unusual child processes of Office applications opening files that should have been in Protected View.
• Correlate with Microsoft and CISA advisories for updated indicators, since the record provides no specific detection signatures.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.