EXPOSURES › CVE-2023-24880
CVE-2023-24880
CRITICAL ⌖ ON CISA KEV · EXPLOITEDAn attacker can bypass Windows SmartScreen's Mark of the Web defenses using a specially crafted malicious file.
This vulnerability allows evasion of MOTW protections, enabling initial access via malicious files. DIB orgs must patch immediately as it is actively exploited in the wild and linked to ransomware campaigns. Failure to patch exposes systems to unauthenticated remote code execution through file-based attacks.
Shame score — A critical, actively exploited bypass in a core Windows security feature directly linked to ransomware, demonstrating severe negligence in patching and defense.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |