CVE-2023-36025

What it actually does

CVE-2023-36025 is a Windows SmartScreen security feature bypass. A remote attacker can craft a malicious file or Internet Shortcut and convince a user to open it, causing Windows to bypass expected SmartScreen / Mark-of-the-Web reputation and warning controls. The vulnerability does not require attacker authentication, but it does require user interaction. Successful exploitation can allow malicious content to run with fewer user-facing warnings, commonly enabling malware execution in the context of the signed-in user and leading to credential theft, persistence, data theft, or follow-on payload deployment.

Why it matters to the business

This vulnerability weakens a key Windows protection that normally warns users before opening risky internet-delivered files. Because it is in CISA KEV, has known in-the-wild exploitation, and has a high EPSS score, unpatched Windows endpoints and servers remain attractive targets for phishing, drive-by download, and malware delivery campaigns. The CISA remediation deadline of 2023-12-05 has long passed, so continued exposure should be treated as a high-priority endpoint security gap that could lead to compromised user workstations, stolen credentials, lateral movement, and operational disruption.

How an attack unfolds

An attacker prepares a specially crafted internet-delivered file, commonly distributed through phishing, malicious links, compromised websites, file-sharing services, or archives attached to email. The attacker entices the victim to open the file or shortcut. On a vulnerable Windows system, SmartScreen protections that would normally display a warning or block reputation-unknown content are bypassed. The opened content then launches or retrieves a malicious payload, often through a browser, Explorer, script host, PowerShell, mshta, rundll32, or another trusted Windows component. The payload executes under the victim user context, after which the attacker can steal browser/session credentials, install persistence, enumerate the host, download additional tools, or pivot further into the environment.

How to fix it

Apply the Microsoft security updates released on or after the November 2023 Patch Tuesday for all affected Windows versions, including Windows 10, Windows 11, Windows Server 2008, 2012, 2016, 2019, and 2022. Where older platforms require Extended Security Updates, ensure the appropriate ESU updates are installed or migrate unsupported systems to supported Windows versions. Keep Microsoft Defender Antivirus, SmartScreen, Microsoft Defender for Endpoint, and browser reputation services enabled and current. As compensating controls, block or quarantine internet-delivered shortcut and script file types where practical, including .url, .lnk, .js, .vbs, .wsf, .hta, .iso, .img, and suspicious archive attachments. Enforce least privilege for users, restrict script interpreters and LOLBins with application control, and use Attack Surface Reduction rules to block executable content from email and webmail.

How to confirm the fix worked

Confirm each Windows endpoint and server has installed the November 2023 cumulative security update or a later cumulative update that supersedes it. Validate OS build numbers against Microsoft’s release history for the relevant Windows version. Confirm SmartScreen and Microsoft Defender reputation-based protection are enabled through Windows Security, Group Policy, Intune, or endpoint management tooling. Test exposure by verifying that internet-downloaded files retain Mark-of-the-Web metadata and trigger expected SmartScreen or Defender controls on patched systems. Review vulnerability management results, patch compliance reports, and EDR device timelines to ensure no affected Windows versions remain missing the relevant cumulative update.

Typical attack path

1. Identify organizations likely to run vulnerable Windows 10, Windows 11, or Windows Server versions.
2. Create a malicious internet-delivered file or shortcut designed to bypass Windows SmartScreen warnings.
3. Deliver the lure through phishing email, messaging platforms, compromised websites, malicious ads, or file-sharing links.
4. Convince the user to open the file or shortcut.
5. Bypass SmartScreen / Mark-of-the-Web warning behavior on an unpatched system.
6. Launch a script, executable, or command chain that retrieves and runs malware.
7. Establish persistence, steal credentials or browser data, and contact attacker-controlled infrastructure.
8. Use the compromised endpoint for lateral movement, data theft, or additional payload deployment.

How to detect it

To determine whether exploitation already occurred, review endpoint, EDR, email security, proxy, and Windows event data for suspicious internet-delivered shortcut or archive activity followed by script or binary execution. Focus on events where files from Downloads, Temp, email attachment caches, browser caches, collaboration-sync folders, or extracted archives launch command interpreters or scripting utilities. In EDR or Sysmon telemetry, look for process chains such as explorer.exe, a browser, Outlook, Teams, or an archive utility spawning powershell.exe, cmd.exe, mshta.exe, wscript.exe, cscript.exe, rundll32.exe, regsvr32.exe, curl.exe, certutil.exe, bitsadmin.exe, or an unsigned executable in a user-writable directory. Review alternate data streams and file metadata for Mark-of-the-Web artifacts, especially suspicious .url or .lnk files with Zone.Identifier, HostUrl, or ReferrerUrl values. Examine Microsoft Defender and SmartScreen logs for suspicious file reputations, blocked or allowed unknown applications, and near-miss detections around the same time as user file-open events. Network teams should inspect outbound traffic immediately following shortcut execution for downloads from newly registered domains, raw file hosting, URL shorteners, paste sites, cloud storage links, and unusual HTTP user agents. Because exploitation is often used for malware delivery, also hunt for infostealer behaviors such as browser credential database access, mass collection from user profile directories, clipboard access, archive creation in Temp, and outbound posts to unfamiliar hosts.

• .url
• [InternetShortcut]
• Zone.Identifier
• HostUrl=
• ReferrerUrl=
• ZoneId=3
• ZoneId=4
• \Downloads\*.url
• \AppData\Local\Temp\*.url
• \AppData\Local\Temp\*.lnk
• \AppData\Local\Microsoft\Windows\INetCache\
• explorer.exe -> powershell.exe
• explorer.exe -> cmd.exe
• explorer.exe -> mshta.exe
• explorer.exe -> wscript.exe
• explorer.exe -> cscript.exe
• explorer.exe -> rundll32.exe
• outlook.exe -> explorer.exe
• chrome.exe -> powershell.exe
• msedge.exe -> powershell.exe
• powershell.exe -ExecutionPolicy Bypass
• powershell.exe -enc
• powershell.exe -EncodedCommand
• mshta.exe http
• mshta.exe https
• rundll32.exe url.dll,FileProtocolHandler
• regsvr32.exe /s /n /u /i:http
• certutil.exe -urlcache
• bitsadmin.exe /transfer
• curl.exe http
• wget.exe http

What your security team should do

• Treat this as urgent wherever unpatched systems remain because the vulnerability is listed in CISA KEV, exploitation is active in the wild, and the federal remediation deadline has passed.
• Prioritize patching user-facing endpoints, VDI images, jump boxes, administrative workstations, and servers used for browsing, email, or file handling.
• Hunt for phishing-driven execution chains involving .url or .lnk files followed by PowerShell, cmd, mshta, wscript, cscript, rundll32, regsvr32, or browser-spawned downloads.
• Increase monitoring for files opened from archives, downloads directories, email clients, collaboration tools, and temporary internet locations.
• Block or detonate suspicious shortcut files and internet-delivered archives at the email gateway, web proxy, and EDR layer.
• Enable or harden Microsoft Defender Attack Surface Reduction rules, especially rules that block executable content from email and webmail and block abuse of Office child processes.
• Review incidents from November 2023 onward for SmartScreen bypass tradecraft, infostealer execution, suspicious browser credential access, and unexpected outbound command-and-control traffic.
• Where patching is delayed, apply application control policies to prevent untrusted scripts and executables from running from user-writable directories.