CVE-2022-41091

An unpatched bypass in Windows' Mark of the Web feature allowed ransomware actors to evade security controls and execute malicious code.

Microsoft's Mark of the Web (MOTW) feature, designed to flag downloaded files as potentially malicious, contained a bypass vulnerability that attackers exploited to execute arbitrary code. This failure is critical for DIB organizations because it demonstrates how even well-intentioned security features can be undermined by unpatched flaws, leading to ransomware infections and data breaches. Organizations must ensure all Windows systems are patched promptly and monitor for KEV-listed vulnerabilities that are actively exploited in the wild.

Shame score — A critical, actively exploited vulnerability in a core Windows security feature that enabled ransomware attacks, representing a severe failure in Microsoft's patch management and security design.