{"id":"CVE-2023-36584","kind":"vulnerability","aliases":["CVE-2023-36584"],"related":[],"title":"Windows Mark of the Web Security Feature Bypass Vulnerability","description":"Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"A flaw in the Windows Mark of the Web feature lets a crafted file bypass the warning that normally marks files downloaded from the internet as untrusted. An attacker who gets a user to open such a file can avoid the Windows security prompts that would otherwise appear.","severity":"medium","cvss":5.4,"epss":null,"exploited":true,"exploited_at":"2023-11-16T00:00:00+00:00","products":[{"name":"Microsoft Windows","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 10 1507","fixed":["10.0.10240.20232"],"affected":"< 10.0.10240.20232","ecosystem":"vendor"},{"name":"microsoft windows 10 1809","fixed":["10.0.17763.4974"],"affected":"< 10.0.17763.4974","ecosystem":"vendor"},{"name":"microsoft windows 10 21h1","fixed":["10.0.19041.3570"],"affected":"< 10.0.19041.3570","ecosystem":"vendor"},{"name":"microsoft windows 10 22h2","fixed":["10.0.19041.3570"],"affected":"< 10.0.19041.3570","ecosystem":"vendor"},{"name":"microsoft windows 11 21h2","fixed":["10.0.22000.2538"],"affected":"< 10.0.22000.2538","ecosystem":"vendor"},{"name":"microsoft windows 11 22h2","fixed":["10.0.22621.2428"],"affected":"< 10.0.22621.2428","ecosystem":"vendor"},{"name":"microsoft windows server 2008","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows server 2008","fixed":[],"affected":"= r2","ecosystem":"vendor"},{"name":"microsoft windows server 2012","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows server 2012","fixed":[],"affected":"= r2","ecosystem":"vendor"},{"name":"microsoft windows server 2016","fixed":["10.0.14393.6351"],"affected":"< 10.0.14393.6351","ecosystem":"vendor"},{"name":"microsoft windows server 2019","fixed":["10.0.17763.4974"],"affected":"< 10.0.17763.4974","ecosystem":"vendor"},{"name":"microsoft windows server 2022","fixed":["10.0.20348.2031"],"affected":"< 10.0.20348.2031","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","windows"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the Microsoft update for CVE-2023-36584 per vendor instructions; CISA says to discontinue use of the product if mitigations are unavailable.\nThe sources do not name the patched build numbers.","status":"open","published_at":"2023-10-10T18:15:14+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:02:48+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-23T21:02:48Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft update for CVE-2023-36584 per vendor instructions; CISA says to discontinue use of the product if mitigations are unavailable.\nThe sources do not name the patched build numbers.","reach":"local","impact":"low","summary":"A flaw in the Windows Mark of the Web feature lets a crafted file bypass the warning that normally marks files downloaded from the internet as untrusted. An attacker who gets a user to open such a file can avoid the Windows security prompts that would otherwise appear.","category":"infrastructure","who_cares":["windows"],"confidence":0.5,"needs_auth":"no","worst_case":"Untrusted downloaded files open without Mark of the Web security warnings.","analyst_note":"Find the Microsoft advisory for CVE-2023-36584 to get affected builds, patched KB numbers and the detection method; the sources only give the CISA KEV entry.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000476,"input_tokens":2828,"output_tokens":386,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2023':11A,14A '-36584':12A,15A '10':20A,24A,28A,32A '11':36A,40A '1507':21A '1809':25A '2008':45A,49A '2012':53A,57A '2016':61A '2019':65A '2022':69A '21h1':29A '21h2':37A '22h2':33A,41A 'action':148C 'appear':120B 'appli':149C 'attack':101B 'avail':142C 'avoid':112B 'bypass':8A,87B,132C 'cisa':146C 'contain':128C 'craft':85B 'cve':10A,13A 'discontinu':155C 'download':94B 'exploit':70B 'featur':7A,82B,131C,145C 'file':86B,93B,110B 'flaw':74B 'get':103B 'infrastructur':71B 'instruct':153C 'integr':140C 'internet':97B 'let':83B 'limit':137C 'loss':138C 'mark':2A,78B,92B,123C 'microsoft':16A,18A,22A,26A,30A,34A,38A,42A,46A,50A,54A,58A,62A,66A,121C 'mitig':150C,161C 'motw':127C 'normal':91B 'open':107B 'otherwis':119B 'per':151C 'product':159C 'prompt':116B 'requir':147C 'result':134C 'secur':6A,115B,130C,144C 'server':44A,48A,52A,56A,60A,64A,68A 'unavail':163C 'untrust':99B 'use':156C 'user':105B 'vendor':152C 'vulner':9A,133C 'warn':89B 'web':5A,81B,126C 'window':1A,72B,77B,114B,122C 'windows':17A,19A,23A,27A,31A,35A,39A,43A,47A,51A,55A,59A,63A,67A 'would':118B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-10-10T18:15:14+00:00","kev":{"dateAdded":"2023-11-16","dueDate":"2023-12-07","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-36584","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36584","severity":null,"published_at":"2023-11-16T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T16:39:47+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-36584","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36584","severity":null,"published_at":"2023-10-10T18:15:14+00:00","modified_at":"2026-06-17T06:06:36+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}