What is the fix for CVE-2022-44698?

Apply the Microsoft update for CVE-2022-44698 per vendor instructions, as CISA requires.

Live › vulnerability › CVE-2022-44698

medium5.4Exploited in the wildVendor

Windows SmartScreen Security Feature Bypass Vulnerability

Microsoft Defender SmartScreen has a security feature bypass that lets a crafted malicious file evade Mark of the Web warnings. CISA lists it as exploited in the wild and tied to ransomware campaigns.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

5.4

medium

scored by [email protected]

known so far4 of 6

missing: how to check, primary source

First public: Dec 13, 2022 UTC
Last modified: Jun 17, 2026
Status: open
Known exploitation: Listed in CISA KEV
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.

Why it is medium, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: Yes, on CISA KEV since Dec 13, 2022.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Malicious downloaded files bypass SmartScreen warnings, enabling malware execution on user machines.
CVSS said: 5.4. The facts above say critical; exploitation in the wild moves it to medium.

Known exploitation

CISA KEV

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2022-44698

Go to dashboard

medium5.4Exploited in the wildVendor

Windows SmartScreen Security Feature Bypass Vulnerability

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

5.4

medium

scored by [email protected]

known so far4 of 6

missing: how to check, primary source

First public: Dec 13, 2022 UTC
Last modified: Jun 17, 2026
Status: open
Known exploitation: Listed in CISA KEV
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.

Why it is medium, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: Yes, on CISA KEV since Dec 13, 2022.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Malicious downloaded files bypass SmartScreen warnings, enabling malware execution on user machines.
CVSS said: 5.4. The facts above say critical; exploitation in the wild moves it to medium.

Known exploitation

CISA KEV

Know the next one before it finds you.

Add to Slack

Product	Ecosystem	Affected	Fixed in
Microsoft Defender	vendor	–	–
microsoft windows 10 1607	vendor	< 10.0.14393.5582	10.0.14393.5582
microsoft windows 10 1809	vendor	< 10.0.17763.3770	10.0.17763.3770
microsoft windows 10 20h2	vendor	< 10.0.19042.2364	10.0.19042.2364
microsoft windows 10 21h1	vendor	< 10.0.19043.2364	10.0.19043.2364
microsoft windows 10 21h2	vendor	< 10.0.19044.2364	10.0.19044.2364
microsoft windows 10 22h2	vendor	< 10.0.19045.2364	10.0.19045.2364
microsoft windows 11 21h2	vendor	< 10.0.22000.1335	10.0.22000.1335
microsoft windows server 2016	vendor	< 10.0.14393.5582	10.0.14393.5582
microsoft windows server 2019	vendor	< 10.0.17763.3770	10.0.17763.3770
microsoft windows server 2022	vendor	< 10.0.20348.1366	10.0.20348.1366

Windows SmartScreen Security Feature Bypass Vulnerability

Why it is medium, and not just CVSS

Known exploitation

Know the next one before it finds you.

Windows SmartScreen Security Feature Bypass Vulnerability

Why it is medium, and not just CVSS

Known exploitation

Know the next one before it finds you.

Who is affected

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources