Windows Mark of the Web Security Feature Bypass Vulnerability

Summary

Microsoft Windows is affected by this vulnerability, which allows an attacker to bypass the Mark of the Web security feature. As a result, files downloaded from the internet may not be flagged as untrusted, so security warnings that would normally appear before opening them can be skipped.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Timeline

1. Nov 8, 2022Added to CISA KEV

   CISA has evidence of exploitation in the wild

2. Nov 9, 2022, 12:00 AM UTCCVE published
3. Dec 9, 2022CISA remediation deadline

   Due date for US federal agencies to patch

4. Aug 10, 2026, 3:11 PM UTCRecord last updated

Affected versions

• Microsoft Windows 10 Version 1507

  From 10.0.10240.0 · fixed in 10.0.10240.19567

• Microsoft Windows 10 Version 1607

  From 10.0.14393.0 · fixed in 10.0.14393.5501

• Microsoft Windows 10 Version 1809

  From 10.0.17763.0 · fixed in 10.0.17763.3650

• Microsoft Windows 10 Version 1809

  From 10.0.0 · fixed in 10.0.17763.3650

• Microsoft Windows 10 Version 20H2

  From 10.0.0 · fixed in 10.0.19042.2251

• Microsoft Windows 10 Version 21H1

  From 10.0.0 · fixed in 10.0.19043.2251

• Microsoft Windows 10 Version 21H2

  From 10.0.19043.0 · fixed in 10.0.19044.2251

• Microsoft Windows 10 Version 22H2

  From 10.0.19045.0 · fixed in 10.0.19045.2251

• Microsoft Windows 11 version 21H2

  From 10.0.0 · fixed in 10.0.22000.1219

• Microsoft Windows 11 version 22H2

  From 10.0.22621.0 · fixed in 10.0.22621.819

• Microsoft Windows Server 2016

  From 10.0.14393.0 · fixed in 10.0.14393.5501

• Microsoft Windows Server 2016 (Server Core installation)

  From 10.0.14393.0 · fixed in 10.0.14393.5501

• Microsoft Windows Server 2019

  From 10.0.17763.0 · fixed in 10.0.17763.3650

• Microsoft Windows Server 2019 (Server Core installation)

  From 10.0.17763.0 · fixed in 10.0.17763.3650

• Microsoft Windows Server 2022

  From 10.0.20348.0 · fixed in 10.0.20348.1249

References 1