CVE-2023-36025: Microsoft Windows SmartScreen Security Feature Bypass Vulnerability
What It Is – Microsoft Windows SmartScreen can be tricked into bypassing its built‑in reputation checks, allowing malicious files to run without the usual warning prompts.
Exploitability – Publicly disclosed; proof‑of‑concept code exists. The CVSS v3.1 base score is 7.8 (High), indicating a high likelihood of successful exploitation in the wild.
Affected Products – All supported versions of Microsoft Windows that include the SmartScreen feature (Windows 10, Windows 11, and Windows Server editions).
Why It Matters for Trust & Control Assurance
- Continuous monitoring of endpoint protection controls is essential; a bypass defeats the “defensible evidence” that SmartScreen provides during audits.
- Demonstrable due‑diligence now requires verification that anti‑malware and application‑control policies are enforced despite known bypasses.
- Enterprise buyers increasingly demand proof that security controls are both implemented and effectively operating, not just enabled in configuration.
Recommended Actions
- Deploy Microsoft’s security update that addresses CVE‑2023‑36025 immediately.
- Verify SmartScreen status post‑patch via PowerShell (
Get-MpPreference) and ensure the feature is active. - Augment SmartScreen with complementary application‑control solutions (e.g., Windows Defender Application Control or third‑party whitelisting) and capture evidence of their enforcement.
- Update your control‑mapping inventory to reflect the new mitigation and map the change to the relevant control objective (endpoint protection).
Source: CISA KEV – CVE‑2023‑36025