CVE-2023-24880: medium-severity vulnerability in Microsoft Windows 10 Version 1607
Windows SmartScreen Security Feature Bypass Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply updates per vendor instructions.
Windows SmartScreen, a security feature that warns users about potentially dangerous files and websites, can be bypassed by attackers. This allows malicious files or phishing sites to bypass protections that would normally block them.
CWE-863 (Incorrect Authorization) allows attackers to bypass SmartScreen's file and URL reputation checks through improper validation mechanisms. The vulnerability requires user interaction but enables delivery of malware or phishing content that would otherwise be blocked by the security feature.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.