Windows Mark of the Web (MotW) Security Feature Bypass Vulnerability Technical Advisory (CVE-2023-36584)
Executive & SecOps Summary
SECOPS ASSESSMENTAll supported versions of Microsoft Windows 10, 11, and Windows Server
Attackers can bypass MotW warnings and SmartScreen blocks to execute malicious files without user warnings
Apply the latest Microsoft Cumulative Updates (LCU) immediately and harden SmartScreen policies
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Deploy the latest Microsoft Cumulative Update (LCU) to resolve the MotW bypass logic. You can force the update installation via PowerShell as follows:
# Install Windows Update module and apply all pending security patches
Install-Module PSWindowsUpdate -Force -Verbose
Get-WindowsUpdate -AcceptAll -Install -AutoReboot2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, enforce SmartScreen policies and block execution of unvalidated files via registry modifications.
# Enforce SmartScreen and set the block level to prevent bypasses
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System' -Name 'EnableSmartScreen' -Value 1 -Type DWord
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System' -Name 'ShellSmartScreenLevel' -Value 'Block' -Type String3. Log Audit & IoC Verification Commands
Run the following script to audit downloaded executable files that lack the Zone.Identifier stream, which may indicate a bypass attempt or untrusted execution.
# Scan the Downloads directory for executables missing the Zone.Identifier stream
Get-ChildItem -Path '$env:USERPROFILE\Downloads' -Recurse -File | ForEach-Object {
$file = $_.FullName
$streams = Get-Item -Path $file -Stream * | Select-Object -ExpandProperty Stream
if ($streams -notcontains 'Zone.Identifier' -and ($file -like '*.exe' -or $file -like '*.bat' -or $file -like '*.vbs')) {
Write-Warning 'Suspicious executable without MotW stream: '$file
}
}Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2023-36584) is a security feature bypass vulnerability in Microsoft Windows that allows attackers to evade the 'Mark of the Web (MotW)' and SmartScreen security warnings. Windows utilizes the Zone.Identifier Alternate Data Stream (ADS) to flag files downloaded from untrusted zones. A logical flaw in how Windows processes specific file formats or container structures allows these files to bypass the MotW propagation mechanism.
2. Exploitation Mechanics & Attack Scenario
An attacker typically delivers a specially crafted archive or container file (such as ZIP, ISO, or VHD) via phishing emails, malicious websites, or drive-by downloads. When a user extracts or opens the container, Windows Explorer fails to correctly propagate or validate the Zone.Identifier stream to the extracted payload. Consequently, the operating system treats the malicious payload as a trusted local file, executing it without triggering any SmartScreen warnings or user prompts.
3. Infrastructure & Business Impact
This vulnerability is actively exploited in the wild and is listed in the CISA KEV catalog. If exploited, it serves as a critical initial access vector, allowing threat actors to deploy ransomware, remote access trojans (RATs), or info-stealers while evading standard endpoint detection mechanisms, potentially leading to full network compromise and severe business disruption.
Official Vendor Advisories & References
Windows Mark of the Web Security Feature Bypass Vulnerability
Frequently Asked SecOps Questions (CVE-2023-36584)
FAQQ1. How critical is CVE-2023-36584 and is it actively exploited in the wild?
CVE-2023-36584 is rated CVSS 5.4 (MEDIUM) with a 30-day EPSS exploitation probability of 3.3%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2023-36584?
Primary impacted vendors include microsoft across windows. Scope summary: All supported versions of Microsoft Windows 10, Windows 11, and Windows Server 2016, 2019, 2022
Q3. What temporary mitigations or workarounds exist for CVE-2023-36584 before patching?
[Mitigation] Apply the latest Microsoft Cumulative Updates (LCU) immediately and harden SmartScreen policies Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2023-36584
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (microsoft)
View Category →Microsoft Windows Shell Security Feature Bypass Vulnerability (CVE-2026-21510) Urgent Security Advisory
[Affected Scope] Windows Shell component across Microsoft Windows operating systems
Windows ALPC Heap-Based Buffer Overflow Privilege Escalation Vulnerability (CVE-2026-85880) Security Advisory
[Affected Scope] Locally authenticated users across Microsoft Windows operating systems
Windows Update Stack Privilege Escalation Vulnerability via Link Following (CVE-2026-81963) Technical Advisory
[Affected Scope] Microsoft Windows operating systems utilizing the Windows Update Stack
Windows AFD.sys Use-After-Free Local Privilege Escalation Vulnerability (CVE-2026-68820) Security Advisory
[Affected Scope] Systems running Microsoft Windows operating systems utilizing the Ancillary Function Driver for WinSock (afd.sys)
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.