CVE-2023-36025

Assessment

Why it matters

CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 88.2%; technical severity is CVSS 8.8.

Windows SmartScreen Security Feature Bypass Vulnerability

Who should care

• Teams operating Windows, Windows 10 1507, Windows 10 1607 +11 more
• Vulnerability and exposure management teams
• Security operations teams monitoring exploitation activity

Response plan

What I would do

1. Confirm whether Windows, Windows 10 1507, Windows 10 1607 +11 more is present in the environment.
2. Identify affected versions and establish whether vulnerable services are exposed or reachable.
3. Microsoft Security patch CVE-2023-36025
4. Review relevant security telemetry for evidence of attempted or successful exploitation.
5. Document the remediation decision and track it to verified completion.

Technical details

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

Not classified

Affected versions

Microsoft Windows; Microsoft Windows 10 1507 (Version - | Version -); Microsoft Windows 10 1607 (Version - | Version -); Microsoft Windows 10 1809 (Version - | Version - | Version -); Microsoft Windows 10 21h2 (Version - | Version - | Version -); Microsoft Windows 10 22h2 (Version - | Version - | Version -); Microsoft Windows 11 21h2 (Version - | Version -); Microsoft Windows 11 22h2 (Version - | Version -)

Fixed versions

Microsoft Windows Server 2016 (Fixed from 10.0.14393.6452); Microsoft Windows Server 2019 (Fixed from 10.0.17763.5122); Microsoft Windows Server 2022 (Fixed from 10.0.20348.2113)

Published

14 November 2023

Attack vector

Network

Privileges required

None

User interaction

Required

Signal timeline

1. 14 Nov 2023CVE published
2. 13 Nov 2023Added to CISA KEV
3. 19 Aug 2026Latest EPSS score: 88.2%
4. 19 Aug 2026 · 12:58 UTCSignal calculated at 83

External references

• CISA Government advisory CVE-2023-36025 ↗