{"id":"CVE-2022-41091","kind":"vulnerability","aliases":["CVE-2022-41091"],"related":[],"title":"Windows Mark of the Web Security Feature Bypass Vulnerability","description":"Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Windows Mark of the Web (MOTW) can be bypassed, so files that should carry the internet-origin warning get treated as trusted. An attacker who gets a crafted file to a user can use this to slip past Windows security prompts and run content they would otherwise be blocked from.","severity":"high","cvss":5.4,"epss":null,"exploited":true,"exploited_at":"2022-11-08T00:00:00+00:00","products":[{"name":"Microsoft Windows","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 10 1507","fixed":["10.0.10240.19567"],"affected":"< 10.0.10240.19567","ecosystem":"vendor"},{"name":"microsoft windows 10 1607","fixed":["10.0.14393.5501"],"affected":"< 10.0.14393.5501","ecosystem":"vendor"},{"name":"microsoft windows 10 1809","fixed":["10.0.17763.3650"],"affected":"< 10.0.17763.3650","ecosystem":"vendor"},{"name":"microsoft windows 10 20h2","fixed":["10.0.19042.2251"],"affected":"< 10.0.19042.2251","ecosystem":"vendor"},{"name":"microsoft windows 10 21h1","fixed":["10.0.19043.2251"],"affected":"< 10.0.19043.2251","ecosystem":"vendor"},{"name":"microsoft windows 10 21h2","fixed":["10.0.19044.2251"],"affected":"< 10.0.19044.2251","ecosystem":"vendor"},{"name":"microsoft windows 10 22h2","fixed":["10.0.19045.2251"],"affected":"< 10.0.19045.2251","ecosystem":"vendor"},{"name":"microsoft windows 11 21h2","fixed":["10.0.22000.1219"],"affected":"< 10.0.22000.1219","ecosystem":"vendor"},{"name":"microsoft windows 11 22h2","fixed":["10.0.22621.819"],"affected":"< 10.0.22621.819","ecosystem":"vendor"},{"name":"microsoft windows server 2016","fixed":["10.0.14393.5501"],"affected":"< 10.0.14393.5501","ecosystem":"vendor"},{"name":"microsoft windows server 2019","fixed":["10.0.17763.3650"],"affected":"< 10.0.17763.3650","ecosystem":"vendor"},{"name":"microsoft windows server 2022","fixed":["10.0.20348.1249"],"affected":"< 10.0.20348.1249","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","ransomware","windows"],"not_affected_if":[],"how_to_check":null,"fix":"Apply the Microsoft security update for CVE-2022-41091 per vendor instructions (CISA KEV required action).","status":"open","published_at":"2022-11-08T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:09:01+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:09:01Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft security update for CVE-2022-41091 per vendor instructions (CISA KEV required action).\nunknown","reach":"internet","impact":"medium","summary":"Windows Mark of the Web (MOTW) can be bypassed, so files that should carry the internet-origin warning get treated as trusted. An attacker who gets a crafted file to a user can use this to slip past Windows security prompts and run content they would otherwise be blocked from.","category":"infrastructure","who_cares":["windows"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker bypasses MOTW warnings and runs malicious files without prompts","analyst_note":"Find the fixed Windows build numbers and affected versions in the Microsoft Security Update Guide entry for CVE-2022-41091 (msrc.microsoft.com) and confirm how to check patch level.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000467,"input_tokens":2812,"output_tokens":372,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2022':11A,14A '-41091':12A,15A '10':20A,24A,28A,32A,36A,40A,44A '11':48A,52A '1507':21A '1607':25A '1809':29A '2016':57A '2019':61A '2022':65A '20h2':33A '21h1':37A '21h2':41A,49A '22h2':45A,53A 'action':147C 'appli':148C 'attack':94B 'avail':141C 'block':119B 'bypass':8A,78B,131C 'carri':83B 'cisa':145C 'contain':127C 'content':114B 'craft':98B 'cve':10A,13A 'exploit':66B 'featur':7A,130C,144C 'file':80B,99B 'get':89B,96B 'infrastructur':67B 'instruct':152C 'integr':139C 'internet':86B 'internet-origin':85B 'limit':136C 'loss':137C 'mark':2A,71B,122C 'microsoft':16A,18A,22A,26A,30A,34A,38A,42A,46A,50A,54A,58A,62A,120C 'motw':75B,126C 'origin':87B 'otherwis':117B 'past':108B 'per':150C 'prompt':111B 'ransomwar':68B 'requir':146C 'result':133C 'run':113B 'secur':6A,110B,129C,143C 'server':56A,60A,64A 'slip':107B 'treat':90B 'trust':92B 'updat':149C 'use':104B 'user':102B 'vendor':151C 'vulner':9A,132C 'warn':88B 'web':5A,74B,125C 'window':1A,69B,70B,109B,121C 'windows':17A,19A,23A,27A,31A,35A,39A,43A,47A,51A,55A,59A,63A 'would':116B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-11-08T00:00:00+00:00","kev":{"dateAdded":"2022-11-08","dueDate":"2022-12-09","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-41091","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-41091","severity":null,"published_at":"2022-11-08T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T13:39:31+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-41091","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41091","severity":null,"published_at":"2022-11-09T22:15:22+00:00","modified_at":"2026-08-10T16:18:20+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}