{"id":"CVE-2022-44698","published":"2022-12-13T19:15:14Z","modified":"2026-06-17T05:08:47Z","title":"Microsoft Defender SmartScreen Security Feature Bypass Vulnerability","vendor":"Microsoft","product":"Defender","tier":"core","eol":null,"description":{"text":"Windows SmartScreen Security Feature Bypass Vulnerability","provenance":"source","from":"NVD"},"summary":{"text":"A security feature bypass vulnerability exists in Microsoft Defender's SmartScreen component, which is part of the Windows SmartScreen protection feature, and it stems from improper handling of exceptional conditions. An unauthenticated remote attacker who can get a user to interact with a crafted resource can bypass SmartScreen's protections, with the bypass yielding limited integrity and availability impact.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:02:44Z"},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","provenance":"source","from":"NVD"},"epss":{"score":0.76267,"percentile":0.99536,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2022-12-13","dueDate":"2023-01-03","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44698;  https://nvd.nist.gov/vuln/detail/CVE-2022-44698","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-12-13","exploitedFirstSeen":"2022-12-13","ransomware":true,"evidence":[{"url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2022-Dec","date":"2022-12-13"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-12-13"},{"url":"https://www.securityweek.com/patch-tuesday-microsoft-plugs-windows-hole-exploited-ransomware-attacks","date":"2022-12-13"},{"url":"https://www.bleepingcomputer.com/news/security/microsoft-patches-windows-zero-day-used-to-drop-ransomware/","date":"2022-12-14"},{"url":"https://info.securin.io/hubfs/Securin%20Ransomware%20Report%202023.pdf","date":"2023-02-14"},{"url":"https://blog.google/threat-analysis-group/magniber-ransomware-actors-used-a-variant-of-microsoft-smartscreen-bypass/","date":"2023-03-14"},{"url":"https://www.mandiant.com/resources/blog/zero-days-exploited-2022","date":"2023-03-20"},{"url":"https://ti.qianxin.com/uploads/2024/02/02/dcc93e586f9028c68e7ab34c3326ff31.pdf","date":"2024-02-02"},{"url":"https://go.recordedfuture.com/hubfs/reports/cta-2024-0208.pdf","date":"2024-02-08"}],"evidenceTotal":9,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-755","name":"Improper Handling of Exceptional Conditions"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44698","tags":["Patch","Vendor Advisory"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44698","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-44698","tags":["US Government Resource"]}],"techniques":[{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Requires user to open malicious file","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Windows SmartScreen Security Feature Bypass Vulnerability","start":0,"end":57}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1211","name":"Exploitation for Stealth","tactics":["stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Bypasses SmartScreen security feature","mappingType":"primary_impact","evidence":[{"from":"description","quote":"Windows SmartScreen Security Feature Bypass Vulnerability","start":0,"end":57}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-b804e28bf5894dd4955f","title":"Whitepaper Name Goes","publisher":"trustwave.com","url":"https://www.trustwave.com/hubfs/Web/Library/Documents_pdf/Trustwave_SpiderLabs_2023_Hospitality_Sector_Threat_Landscape.pdf","date":null,"mentions":[{"quote":"blocks and exploit vulnerabilities such as CVE-2022-44698.","start":101671,"end":101729}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-47632","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-47632","exploited":true,"exploitedSince":"2022-12-13","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1204.002"],"provenance":"ai"},{"stage":"primary","techniques":["T1211"],"provenance":"ai"}],"timeline":[{"date":"2022-12-13","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-44698","provenance":"source"},{"date":"2022-12-13","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2022-Dec","provenance":"source"},{"date":"2022-12-13","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-12-13","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-47632","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":0},"priority":{"score":75.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1416 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.91,"detail":"percentile 0.9954"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":3.78,"detail":"base score 5.4"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}