CVE-2024-38213: Windows Mark of the Web security feature bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is in CISA KEV with confirmed in-the-wild exploitation and a high EPSS percentile, though it requires user interaction and only bypasses a defense rather than directly executing code.

What it is

Windows Mark of the Web (MotW) fails to properly apply its security marking, allowing a crafted file to be treated as trusted. Because MotW drives SmartScreen and Office Protected View trust decisions, bypassing it removes a key defense against malicious files. The record gives no root-cause detail beyond a general security feature bypass classification.

Impact

An attacker can get a malicious file to open without the usual MotW warnings or Protected View restrictions, increasing the chance of code execution or credential theft on the target host. The CVSS vector shows high integrity impact with no confidentiality or availability impact.

Attack surface

Reached over the network with no privileges required, but the victim must interact with a crafted file or link (UI:R). No authentication is needed; the user is the gate.

Exploitation

Listed in CISA KEV with a 2024-08-13 addition and 2024-09-03 remediation due date, indicating known exploitation in the wild. EPSS 30-day probability is about 13.6 percent (96th percentile), and no ransomware campaign use is recorded.

What to do

• Apply the Microsoft August 2024 security update for the affected Windows versions listed in the MSRC advisory.
• Prioritize patching internet-facing and user-workstation systems, since exploitation requires user interaction.
• Enforce SmartScreen and Office Protected View policies and restrict execution of files from untrusted locations.
• Follow CISA KEV required action: apply vendor mitigations or discontinue use of the product if mitigations are unavailable.

Detection

• Monitor for files that execute or open without expected Mark of the Web attributes, especially from email, browser or archive sources.
• Alert on SmartScreen or Protected View bypass events and unusual child processes spawned from downloaded documents.
• Hunt for known exploitation artifacts around the KEV due date window using endpoint and email telemetry.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.