{"id":"CVE-2023-36025","kind":"vulnerability","aliases":["CVE-2023-36025"],"related":[],"title":"Windows SmartScreen Security Feature Bypass Vulnerability","description":"Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to bypass Windows Defender SmartScreen checks and their associated prompts.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"Windows SmartScreen has a security feature bypass that lets an attacker get past its checks and warning prompts on downloaded or opened content. It is listed in CISA's Known Exploited Vulnerabilities catalog, so attacks have been observed in the wild.","severity":"high","cvss":8.8,"epss":null,"exploited":true,"exploited_at":"2023-11-14T00:00:00+00:00","products":[{"name":"Microsoft Windows","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 10 1507","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 10 1607","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 10 1809","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 10 21h2","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 10 22h2","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 11 21h2","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 11 22h2","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 11 23h2","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows server 2008","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows server 2008","fixed":[],"affected":"= r2","ecosystem":"vendor"},{"name":"microsoft windows server 2012","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows server 2012","fixed":[],"affected":"= r2","ecosystem":"vendor"},{"name":"microsoft windows server 2016","fixed":["10.0.14393.6452"],"affected":"< 10.0.14393.6452","ecosystem":"vendor"},{"name":"microsoft windows server 2019","fixed":["10.0.17763.5122"],"affected":"< 10.0.17763.5122","ecosystem":"vendor"},{"name":"microsoft windows server 2022","fixed":["10.0.20348.2113"],"affected":"< 10.0.20348.2113","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["endpoints","exploited","infrastructure","windows"],"not_affected_if":["non-windows"],"how_to_check":"Check the installed Windows build against Microsoft's security update guide for CVE-2023-36025 (unknown whether the sources list affected builds).","fix":"Apply the Microsoft security update for CVE-2023-36025 for your Windows version; if no update is available, follow Microsoft's mitigation instructions or stop using the affected product, per CISA's required action.","status":"open","published_at":"2023-11-14T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:02:50+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:02:50Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft security update for CVE-2023-36025 for your Windows version; if no update is available, follow Microsoft's mitigation instructions or stop using the affected product, per CISA's required action.\nunknown","reach":"unknown","impact":"medium","summary":"Windows SmartScreen has a security feature bypass that lets an attacker get past its checks and warning prompts on downloaded or opened content. It is listed in CISA's Known Exploited Vulnerabilities catalog, so attacks have been observed in the wild.","category":"infrastructure","who_cares":["windows","endpoints"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker bypasses SmartScreen warnings so malicious files run without the usual prompt.","analyst_note":"Find the Microsoft security update guide entry for CVE-2023-36025 to confirm affected builds, patch versions, and mitigation steps.","how_to_check":"Check the installed Windows build against Microsoft's security update guide for CVE-2023-36025 (unknown whether the sources list affected builds).\nunknown","needs_analyst":true,"not_affected_if":["non-windows"],"user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000503,"input_tokens":2828,"output_tokens":441,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2023':8A,11A '-36025':9A,12A '10':17A,21A,25A,29A,33A '11':37A,41A,45A '1507':18A '1607':22A '1809':26A '2008':50A,54A '2012':58A,62A '2016':66A '2019':70A '2022':74A '21h2':30A,38A '22h2':34A,42A '23h2':46A 'action':146C 'allow':131C 'appli':147C 'associ':142C 'attack':89B,113B,133C 'bypass':5A,85B,127C,135C 'catalog':111B 'check':93B,139C 'cisa':106B,144C 'contain':123C 'content':101B 'could':130C 'cve':7A,10A 'defend':137C 'discontinu':153C 'download':98B 'endpoint':75B 'exploit':76B,109B 'featur':4A,84B,126C 'get':90B 'infrastructur':77B 'instruct':151C 'known':108B 'let':87B 'list':104B 'microsoft':13A,15A,19A,23A,27A,31A,35A,39A,43A,47A,51A,55A,59A,63A,67A,71A,120C 'mitig':148C,159C 'observ':116B 'open':100B 'past':91B 'per':149C 'product':157C 'prompt':96B,143C 'requir':145C 'secur':3A,83B,125C 'server':49A,53A,57A,61A,65A,69A,73A 'smartscreen':2A,80B,122C,138C 'unavail':161C 'use':154C 'vendor':150C 'vulner':6A,110B,128C 'warn':95B 'wild':119B 'window':1A,78B,79B,121C,136C 'windows':14A,16A,20A,24A,28A,32A,36A,40A,44A,48A,52A,56A,60A,64A,68A,72A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-11-14T00:00:00+00:00","kev":{"dateAdded":"2023-11-14","dueDate":"2023-12-05","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-36025","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36025","severity":null,"published_at":"2023-11-14T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:23+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-36025","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36025","severity":null,"published_at":"2023-11-14T18:15:31+00:00","modified_at":"2026-06-17T06:05:41+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}