{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1553.005 Mark-of-the-Web Bypass","home_page_url":"https://patchfirst.co/technique/T1553.005/","feed_url":"https://patchfirst.co/feed/technique/T1553.005.json","description":"New and newly exploited CVEs that lead to ATT&CK T1553.005 Mark-of-the-Web Bypass, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2025-0411#kev","url":"https://patchfirst.co/cve/CVE-2025-0411/","title":"[KEV] CVE-2025-0411: 7-Zip Mark of the Web Bypass Vulnerability","content_text":"7-Zip · 7-Zip. In CISA KEV since 2025-02-06. ENISA EUVD lists it as exploited. EPSS 67.1% (higher than 99.3% of CVEs). CVSS 7.0 HIGH. Public exploit code exists. ATT&CK: T1553.005 Mark-of-the-Web Bypass; T1566.001 Spearphishing Attachment; T1588.001 Malware. Priority 67.8 of 100.","summary":"7-Zip Mark of the Web Bypass Vulnerability","date_published":"2025-02-06T00:00:00.000Z","date_modified":"2026-06-17T08:26:25.000Z","tags":["kev","public-exploit","T1553.005","T1566.001","T1588.001"],"_patchfirst":{"reason":"kev","priority":67.8,"kev":{"dateAdded":"2025-02-06","ransomware":false},"epss":{"score":0.67071,"percentile":0.99297},"cvss":{"score":7,"severity":"HIGH","version":"3.1"},"vendor":"7-Zip","product":"7-Zip","techniqueIds":["T1553.005","T1566.001","T1588.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-38217#kev","url":"https://patchfirst.co/cve/CVE-2024-38217/","title":"[KEV] CVE-2024-38217: Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2024-09-10. ENISA EUVD lists it as exploited. EPSS 10.0% (higher than 95.6% of CVEs). CVSS 5.4 MEDIUM. Public exploit code exists. ATT&CK: T1553.005 Mark-of-the-Web Bypass. Priority 65.9 of 100.","summary":"Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure Vulnerability","date_published":"2024-09-10T00:00:00.000Z","date_modified":"2026-08-10T16:19:03.000Z","tags":["kev","public-exploit","T1553.005"],"_patchfirst":{"reason":"kev","priority":65.9,"kev":{"dateAdded":"2024-09-10","ransomware":false},"epss":{"score":0.10026,"percentile":0.9561},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1553.005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-38213#kev","url":"https://patchfirst.co/cve/CVE-2024-38213/","title":"[KEV] CVE-2024-38213: Microsoft Windows SmartScreen Security Feature Bypass Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2024-08-13. ENISA EUVD lists it as exploited. EPSS 13.6% (higher than 96.5% of CVEs). CVSS 6.5 MEDIUM. ATT&CK: T1553.005 Mark-of-the-Web Bypass. Priority 61.8 of 100.","summary":"Microsoft Windows SmartScreen Security Feature Bypass Vulnerability","date_published":"2024-08-13T00:00:00.000Z","date_modified":"2026-06-17T07:39:41.000Z","tags":["kev","T1553.005"],"_patchfirst":{"reason":"kev","priority":61.8,"kev":{"dateAdded":"2024-08-13","ransomware":false},"epss":{"score":0.13626,"percentile":0.96473},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1553.005"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2024-21412#kev","url":"https://patchfirst.co/cve/CVE-2024-21412/","title":"[KEV] CVE-2024-21412: Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2024-02-13, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.4% (higher than 99.94% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1204.001 Malicious Link; T1553.005 Mark-of-the-Web Bypass. Named in 1 threat report. Priority 82.5 of 100.","summary":"Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability","date_published":"2024-02-13T00:00:00.000Z","date_modified":"2026-08-10T16:18:51.000Z","tags":["kev","ransomware","public-exploit","T1204.001","T1553.005"],"_patchfirst":{"reason":"kev","priority":82.5,"kev":{"dateAdded":"2024-02-13","ransomware":true},"epss":{"score":0.9941,"percentile":0.99941},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1204.001","T1553.005"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-21351#kev","url":"https://patchfirst.co/cve/CVE-2024-21351/","title":"[KEV] CVE-2024-21351: Microsoft Windows SmartScreen Security Feature Bypass Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2024-02-13. ENISA EUVD lists it as exploited. EPSS 27.8% (higher than 98.1% of CVEs). CVSS 7.6 HIGH. ATT&CK: T1204.002 Malicious File; T1553.005 Mark-of-the-Web Bypass. Priority 62.9 of 100.","summary":"Microsoft Windows SmartScreen Security Feature Bypass Vulnerability","date_published":"2024-02-13T00:00:00.000Z","date_modified":"2026-08-10T16:18:42.000Z","tags":["kev","T1204.002","T1553.005"],"_patchfirst":{"reason":"kev","priority":62.9,"kev":{"dateAdded":"2024-02-13","ransomware":false},"epss":{"score":0.27798,"percentile":0.9809},"cvss":{"score":7.6,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1204.002","T1553.005"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-36584#kev","url":"https://patchfirst.co/cve/CVE-2023-36584/","title":"[KEV] CVE-2023-36584: Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2023-11-16. ENISA EUVD lists it as exploited. EPSS 3.3% (higher than 88.3% of CVEs). CVSS 5.4 MEDIUM. ATT&CK: T1204.001 Malicious Link; T1553.005 Mark-of-the-Web Bypass. Priority 59.4 of 100.","summary":"Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability","date_published":"2023-11-16T00:00:00.000Z","date_modified":"2026-06-17T06:06:36.000Z","tags":["kev","T1204.001","T1553.005"],"_patchfirst":{"reason":"kev","priority":59.4,"kev":{"dateAdded":"2023-11-16","ransomware":false},"epss":{"score":0.03251,"percentile":0.8832},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1204.001","T1553.005"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-36884#kev","url":"https://patchfirst.co/cve/CVE-2023-36884/","title":"[KEV] CVE-2023-36884: Microsoft Windows Search Remote Code Execution Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2023-07-17, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.4% (higher than 99.94% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1566 Phishing; T1204.002 Malicious File; T1005 Data from Local System; T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery; +1 more. Priority 78.2 of 100.","summary":"Microsoft Windows Search Remote Code Execution Vulnerability","date_published":"2023-07-17T00:00:00.000Z","date_modified":"2026-08-10T16:18:30.000Z","tags":["kev","ransomware","public-exploit","T1566","T1204.002","T1005","T1486","T1489","T1490","T1553.005"],"_patchfirst":{"reason":"kev","priority":78.2,"kev":{"dateAdded":"2023-07-17","ransomware":true},"epss":{"score":0.99439,"percentile":0.99942},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1566","T1204.002","T1005","T1486","T1489","T1490","T1553.005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-32049#kev","url":"https://patchfirst.co/cve/CVE-2023-32049/","title":"[KEV] CVE-2023-32049: Microsoft Windows Defender SmartScreen Security Feature Bypass Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2023-07-11. ENISA EUVD lists it as exploited. EPSS 4.2% (higher than 90.9% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1204.002 Malicious File; T1553.005 Mark-of-the-Web Bypass. Priority 62.3 of 100.","summary":"Microsoft Windows Defender SmartScreen Security Feature Bypass Vulnerability","date_published":"2023-07-11T00:00:00.000Z","date_modified":"2026-06-17T05:57:57.000Z","tags":["kev","T1204.002","T1553.005"],"_patchfirst":{"reason":"kev","priority":62.3,"kev":{"dateAdded":"2023-07-11","ransomware":false},"epss":{"score":0.04156,"percentile":0.90859},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1204.002","T1553.005"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-24880#kev","url":"https://patchfirst.co/cve/CVE-2023-24880/","title":"[KEV] CVE-2023-24880: Microsoft Windows SmartScreen Security Feature Bypass Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2023-03-14, known ransomware use. ENISA EUVD lists it as exploited. EPSS 78.0% (higher than 99.57% of CVEs). CVSS 4.4 MEDIUM. ATT&CK: T1204.001 Malicious Link; T1553.005 Mark-of-the-Web Bypass. Priority 71.0 of 100.","summary":"Microsoft Windows SmartScreen Security Feature Bypass Vulnerability","date_published":"2023-03-14T00:00:00.000Z","date_modified":"2026-06-17T05:40:10.000Z","tags":["kev","ransomware","T1204.001","T1553.005"],"_patchfirst":{"reason":"kev","priority":71,"kev":{"dateAdded":"2023-03-14","ransomware":true},"epss":{"score":0.78005,"percentile":0.99574},"cvss":{"score":4.4,"severity":"MEDIUM","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1204.001","T1553.005"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2022-41049#kev","url":"https://patchfirst.co/cve/CVE-2022-41049/","title":"[KEV] CVE-2022-41049: Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2022-11-14. ENISA EUVD lists it as exploited. EPSS 2.6% (higher than 85.5% of CVEs). CVSS 5.4 MEDIUM. ATT&CK: T1204.001 Malicious Link; T1553.005 Mark-of-the-Web Bypass. Priority 58.9 of 100.","summary":"Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability","date_published":"2022-11-14T00:00:00.000Z","date_modified":"2026-08-10T16:18:15.000Z","tags":["kev","T1204.001","T1553.005"],"_patchfirst":{"reason":"kev","priority":58.9,"kev":{"dateAdded":"2022-11-14","ransomware":false},"epss":{"score":0.02634,"percentile":0.85525},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1204.001","T1553.005"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2022-41091","url":"https://patchfirst.co/cve/CVE-2022-41091/","title":"CVE-2022-41091: Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2022-11-08, known ransomware use. ENISA EUVD lists it as exploited. EPSS 1.9% (higher than 79.8% of CVEs). CVSS 5.4 MEDIUM. ATT&CK: T1204.002 Malicious File; T1553.005 Mark-of-the-Web Bypass. Priority 67.7 of 100.","summary":"Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability","date_published":"2022-11-09T00:00:00.000Z","date_modified":"2026-08-10T16:18:20.000Z","tags":["kev","ransomware","T1204.002","T1553.005"],"_patchfirst":{"reason":"published","priority":67.7,"kev":{"dateAdded":"2022-11-08","ransomware":true},"epss":{"score":0.0191,"percentile":0.79763},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1204.002","T1553.005"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}}]}