Junglewise Threat Intelligence

CVE-2022-44698: Microsoft Defender SmartScreen Security Feature Bypass Vulnerability

CVE-2022-44698 · Severity: critical · CVSS 5.4 · Exploited in the wild · Published 2022-12-13

Technologies: Microsoft Windows 10, Microsoft Windows 11, Microsoft Windows Server 2022, Microsoft Windows Server 2019, Microsoft Windows Server 2016, Microsoft Defender. Vendors: Microsoft.

Executive brief

Microsoft Defender SmartScreen contains a security feature bypass vulnerability that allows attackers to evade Mark of the Web (MOTW) defenses. An attacker can exploit this by crafting a malicious file that bypasses security warnings when downloaded and opened by a user.

Affected products

  • Microsoft Windows 10 1607, 1809, 20H2, 21H1, 21H2, 22H2
  • Microsoft Windows 11 21H2, 22H2
  • Microsoft Windows Server 2016
  • Microsoft Windows Server 2019
  • Microsoft Windows Server 2022

Timeline

  • 2022-12-13: disclosed
  • 2022-12-13: patched
  • 2022-12-13: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
  • 2022-12-13: exploited: Reported as exploited in the wild at time of publication.

Related threats