CVE-2026-45595

What it actually does

This is a Windows Mark of the Web security feature bypass. Mark of the Web is metadata Windows normally applies to files originating from the internet or other untrusted network locations, commonly via the Zone.Identifier alternate data stream. Security features such as Microsoft Defender SmartScreen, Office Protected View, macro blocking, and attachment-handling prompts may rely on that metadata to treat content as untrusted. If exploited, a file delivered over a network may not be properly tagged or may lose that tag, causing downstream protections to treat attacker-supplied content as local or trusted. The flaw does not directly grant code execution by itself, but it can make social-engineering payloads, documents, scripts, archives, or executables easier to run with fewer warnings or restrictions.

Why it matters to the business

Successful exploitation can reduce the effectiveness of Windows user-safety controls that normally warn users before opening internet-origin files. This increases the chance that phishing attachments, downloaded tools, malicious documents, or script payloads are opened and executed, potentially leading to malware infection, credential theft, ransomware staging, or lateral movement when combined with another payload. The CVSS score is moderate, EPSS is currently low, and it is not listed in CISA KEV, but the broad Windows desktop and server exposure means organizations should still remediate through normal patch cycles, especially on user workstations, VDI images, jump boxes, and systems used to browse or handle email attachments.

How an attack unfolds

An attacker prepares a file or delivery workflow intended to avoid correct Mark of the Web tagging. The file may be hosted on a website, file-sharing service, WebDAV/SMB location, or sent through a social-engineering path that causes the victim to download or open content from a network source. The attacker convinces a user to open the file, extract an archive, or run a script or executable. Due to the protection mechanism failure, Windows may fail to apply or preserve the untrusted-zone metadata that normally identifies the file as internet-origin content. As a result, defenses that depend on that metadata may not show expected warnings, may not open content in Protected View, or may not apply stricter handling rules. The attacker then relies on the user opening the payload or enabling further actions, after which a separate malicious payload can execute under the user’s privileges.

How to fix it

Install the applicable Microsoft Windows security updates or latest cumulative updates for all affected Windows 10, Windows 11, and Windows Server versions. Because exact KB or per-build fixed versions were not provided, validate remediation against Microsoft’s official security update guidance for this CVE and ensure all supported builds are fully patched. Prioritize user-facing endpoints, VDI/golden images, administrator workstations, file-handling servers, and systems used to browse the web or process email attachments. As compensating controls, keep Microsoft Defender SmartScreen enabled, enforce Office Protected View and internet macro blocking, use attack surface reduction rules to block Office child processes and executable content from email/webmail, restrict script execution where possible, block high-risk attachment types, inspect archives at email and web gateways, and prevent users from running content from untrusted network shares.

How to confirm the fix worked

Confirm each affected Windows system has received the relevant cumulative security update through Windows Update, WSUS, Microsoft Configuration Manager, Intune, or another patch-management source. Validate OS build and patch state using inventory tooling, Windows Update history, Get-HotFix where applicable, or Microsoft’s official build-to-KB mapping. Perform a controlled test by downloading a benign file from an internet-origin source and verifying that the Zone.Identifier alternate data stream is present and contains an appropriate ZoneId, and that expected controls such as SmartScreen, Office Protected View, or macro blocking still trigger. Also test common workflows such as browser downloads, email attachments, archive extraction, and network-share copies. Review group policy and security baseline settings to ensure attachment handling, SmartScreen, Office macro restrictions, and script controls have not been disabled.

Typical attack path

1. Attacker creates or stages a document, archive, script, shortcut, or executable designed to benefit from missing or bypassed Mark of the Web tagging.
2. Attacker delivers a link or file through phishing, chat, file sharing, compromised website, SMB/WebDAV share, or another network-accessible location.
3. User downloads, copies, extracts, or opens the attacker-controlled content.
4. Windows fails to correctly apply or preserve Mark of the Web metadata on the content.
5. SmartScreen, Protected View, macro-blocking, or attachment warnings that depend on MOTW may not trigger as expected.
6. User opens or runs the payload with fewer prompts or restrictions.
7. A separate payload performs follow-on actions such as malware execution, credential theft, persistence, or lateral movement.

How to detect it

Look for signs that internet-delivered files were opened or executed without expected Mark of the Web metadata. Useful log sources include EDR process telemetry, Windows Security process creation logs, Sysmon Event ID 1 process creation, Sysmon Event ID 11 file creation, Sysmon Event ID 15 file stream creation, Microsoft Defender alerts, SmartScreen events, Office Protected View and macro telemetry, email gateway logs, proxy logs, browser download history, and file-share/WebDAV access logs. Prioritize events where Office, scripting engines, archive utilities, or executable files launch from user-writable download or temporary locations, especially soon after a browser, email client, chat client, or archive utility creates the file. Hunt for files in Downloads, Temp, INetCache, email attachment caches, and extracted archive folders that are executable or script-capable but lack a Zone.Identifier stream. Compare proxy/email delivery times with endpoint execution times to identify files obtained from the internet that did not generate expected MOTW stream-creation events. Also review whether SmartScreen, Protected View, or Office macro-blocking prompts were absent for content that should have been treated as internet-origin. No public exploitation, named threat actors, or stable malware-specific indicators were provided, so detection should focus on behavior and missing expected metadata rather than hashes or fixed signatures.

• Zone.Identifier
• [ZoneTransfer]
• ZoneId=3
• ZoneId=4
• \AppData\Local\Microsoft\Windows\INetCache\
• \AppData\Local\Temp\
• \Downloads\
• \AppData\Local\Microsoft\Windows\Temporary Internet Files\
• \AppData\Local\Microsoft\Windows\Explorer\
• powershell.exe
• wscript.exe
• cscript.exe
• mshta.exe
• rundll32.exe
• regsvr32.exe
• cmd.exe
• winword.exe
• excel.exe
• powerpnt.exe
• outlook.exe
• 7z.exe
• winrar.exe
• explorer.exe

What your security team should do

• Patch affected Windows endpoints and servers through the current Microsoft cumulative security update process, prioritizing user workstations and systems exposed to email, browser, file-share, or administrator workflows.
• Inventory affected Windows 10, Windows 11, and Windows Server versions and identify unsupported or lagging builds that may not receive timely fixes.
• Harden email, web, and endpoint controls so malicious files are blocked even if MOTW metadata is missing or incorrect.
• Enable or verify Microsoft Defender SmartScreen, Office Protected View, internet macro blocking, and relevant Microsoft Defender attack surface reduction rules.
• Increase monitoring for execution of files from Downloads, temporary browser cache locations, email attachment directories, ZIP extraction paths, WebDAV paths, and SMB shares.
• Hunt for recently downloaded or user-opened executable/script/document content that lacks Zone.Identifier metadata where it would normally be expected.
• Educate help desk and users that files from the internet or file-sharing links may be dangerous even when Windows does not display the usual warning prompts.
• Track vendor guidance for this CVE because exploit maturity is currently listed as none and EPSS is low, but MOTW bypasses are commonly useful in phishing chains.