How to Fix CVE-2022-41091: Windows Mark of the Web Security Feature Bypass

By the Sai Kiran Pandrala · Reviewed and edited by Sai Kiran Pandrala, Editor

Patch immediately with the November 2022 cumulative update. CISA's Known Exploited Vulnerabilities catalog lists this CVE, which means active exploitation has been confirmed. CISA KEV entry added 2022-11-08, federal due date 2022-12-09.

What is CVE-2022-41091?

CVE-2022-41091 is a Mark of the Web (MOTW) security feature bypass in Microsoft Windows. It is not a remote code execution bug on its own and it is not a privilege-escalation bug. It is a bypass of a defensive feature, which is why Microsoft rates it CVSS 5.4 Medium with the vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L. The UI:R in that vector matters: a user has to open the malicious file for the bypass to take effect.

Mark of the Web is the small alternate data stream named Zone.Identifier that Windows attaches to any file that arrives from an untrusted zone, such as an email attachment or a browser download. Defenses downstream read that tag. SmartScreen uses it to reputation-check executables, and Office uses it to open documents in Protected View. CVE-2022-41091 lets an attacker craft a file, typically delivered inside a ZIP archive or a mounted disk image such as an ISO, IMG, or VHD, so that the contained payload never receives the MOTW tag. With no tag, SmartScreen stays silent and Protected View never opens. The macro warning, the “this file came from the internet” banner, the publisher-reputation prompt — all of it is skipped.

The practical effect is that a phishing payload that should have produced two or three warnings produces none. That is why this CVE landed on the CISA KEV list within hours of disclosure: it is the silent step that makes the rest of an intrusion chain work.

Why this CVE matters

The CISA ADP record maps this to CWE-863 (Incorrect Authorization) because the security decision — “is this file trusted enough to run without a warning?” — is made incorrectly. Microsoft’s own classification is “Security Feature Bypass.” Both descriptions point at the same behaviour: a trust boundary that is supposed to slow down attacker-supplied files is rendered ineffective.

Affected products span the supported Windows family at the time: Windows 10 (1507, 1607, 1809, 20H2, 21H1, 21H2, 22H2), Windows 11 (21H2 and 22H2), and Windows Server 2016, 2019, and 2022, including Server Core installations. If your fleet runs any of these on a build older than the November 2022 cumulative update, the bypass is live. Because exploitation only needs a user to open a file, every workstation that handles email or downloads is in scope — this is not a server-only concern.

Identify whether you are affected

This is a Windows operating-system flaw, so the only check that matters is the OS build number. Compare it against the fixed builds in the table above. The fastest way is winver, which prints the build directly:

# Quick interactive check
winver

# Scriptable build read (matches the build column in the glance table)
[System.Environment]::OSVersion.Version
(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').CurrentBuildNumber + '.' + `
  (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').UBR

The value you get back is <CurrentBuildNumber>.<UBR>, for example 22621.819. If your UBR is below the fixed value for your release (819 for Windows 11 22H2, 2251 for Windows 10 22H2/21H2, 3650 for 1809 and Server 2019, and so on), you are vulnerable. Check whether the November 2022 rollup is already installed by KB:

# Was a November 2022 cumulative update installed?
Get-HotFix | Where-Object { $_.InstalledOn -ge '2022-11-08' } | Sort-Object InstalledOn -Descending

How to fix CVE-2022-41091

The fix is the November 2022 Patch Tuesday cumulative update (released 2022-11-08). There is no separate hotfix and no standalone component to upgrade — the monthly Windows quality update carries the corrected MOTW handling. The exact KB depends on your release; install the latest cumulative update and you will be at or past the fixed build. Representative November 2022 KBs are KB5019980 (Windows 11 21H2), KB5019961 (Windows 10 22H2/21H2/20H2), KB5019966 (Windows 10 1809 / Server 2019), and KB5019081 (Server 2022). Confirm the current KB for your build against the MSRC advisory before deploying.

Windows Update (recommended for individual machines)

# Run elevated. Trigger a scan and install of pending quality updates.
# Option A: built-in update client
UsoClient StartScan
UsoClient StartInstall

# Option B: PSWindowsUpdate module if you manage updates with PowerShell
Install-Module PSWindowsUpdate -Force -SkipPublisherCheck -Confirm:$false
Import-Module PSWindowsUpdate
Get-WindowsUpdate -MicrosoftUpdate
Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -AutoReboot

Offline install from the Microsoft Update Catalog

For machines without internet access, download the cumulative update KB that matches your release from the Microsoft Update Catalog and apply the MSU:

# Replace the KB number and filename with the one for your release/architecture.
wusa.exe C:\Patches\windows10.0-kb5019966-x64.msu /quiet /norestart

# Or apply with DISM against a downloaded .cab
DISM /Online /Add-Package /PackagePath:C:\Patches\windows10.0-kb5019966-x64.cab

shutdown /r /t 60 /c "Rebooting to complete CVE-2022-41091 patch"

Fleet rollout (WSUS / SCCM / Intune)

# WSUS: approve the November 2022 cumulative update for the target groups,
# then force clients to detect and report:
wuauclt /detectnow /reportnow
# or on modern builds:
UsoClient StartScan

# Intune: the November 2022 quality update is delivered through the
# Windows Update for Business / Update Ring policy. Confirm the ring's
# deferral period is not holding the update back, then check device
# compliance for "Latest cumulative update installed".

After the cumulative update installs and the machine reboots, the corrected MOTW propagation is active. No service restart is needed beyond the reboot the update already requires.

If you can't patch immediately

There is no supported registry toggle that disables this specific bypass — Mark of the Web is the mitigation, and the patch is what makes it propagate correctly again. So the interim controls focus on stopping the delivery vehicle rather than the flaw itself:

• Block disk-image and nested-archive attachments at the mail gateway. The common exploitation path wraps the payload in an ISO, IMG, VHD, or a ZIP-inside-ZIP so the inner file dodges MOTW. Quarantine or strip these container types inbound.
• Enable Microsoft Defender Attack Surface Reduction (ASR) rules, particularly “Block executable content from email client and webmail” and “Block execution of potentially obfuscated scripts.”

# Turn on the email-content ASR rule in Block mode (GUID is Microsoft's fixed ID).
Set-MpPreference -AttackSurfaceReductionRules_Ids BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 `
                 -AttackSurfaceReductionRules_Actions Enabled
# Verify the rule is active:
(Get-MpPreference).AttackSurfaceReductionRules_Ids

• Keep SmartScreen and Protected View enforced by policy so that any file which does retain its MOTW tag still triggers the warnings. These do not fix the bypass, but they preserve the defense for files the bypass does not reach.

Treat all of the above as exposure reduction. The November 2022 cumulative update is the only thing that closes CVE-2022-41091.

Confirm the fix landed

After patching and rebooting, re-read the OS build and confirm it is at or above the fixed value for your release:

# Build number should now meet the fixed build in the glance table.
[System.Environment]::OSVersion.Version

# Confirm the specific cumulative-update KB is present.
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5

Then run an authenticated vulnerability scan with a current signature set and confirm the scanner no longer flags CVE-2022-41091. Because exploitation requires a user to open a crafted file, also review email gateway and EDR telemetry over the period the fleet was unpatched for inbound ISO/IMG/VHD attachments and for SmartScreen or Protected View prompts that should have fired but did not.

Frequently asked questions

What does the Mark of the Web bypass in CVE-2022-41091 actually do?

It lets a crafted file evade the Zone.Identifier Mark of the Web tag that Windows attaches to downloaded content. Once the file is no longer marked as web-sourced, SmartScreen and Office Protected View do not trigger, so the warnings a user would normally see are silently skipped. The payload is typically delivered inside a ZIP archive or a mounted disk image such as an ISO.

Which Windows build fixes CVE-2022-41091?

The November 2022 cumulative update. Fixed builds include Windows 11 22H2 build 22621.819, Windows 11 21H2 build 22000.1219, Windows 10 22H2/21H2 builds 19045.2251 and 19044.2251, Windows 10 1809 and Server 2019 build 17763.3650, Windows Server 2022 build 20348.1249, and Server 2016 / Windows 10 1607 build 14393.5501. Run winver to compare your build.

Is CVE-2022-41091 being exploited in the wild?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 2022-11-08, confirming active exploitation. The KEV record for this entry does not flag known ransomware-campaign use.

Can I mitigate CVE-2022-41091 without patching?

There is no clean registry workaround for the bypass itself. As interim hardening, block or quarantine inbound disk images and nested archives (ISO, IMG, VHD, ZIP-in-ZIP) at the mail gateway and enable the relevant Defender ASR rules. These reduce delivery, not the underlying flaw, so schedule the November 2022 cumulative update as the real fix.

References

• Official vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41091
• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2022-41091
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CISA KEV record: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41091
• Additional reference: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41091

This guide was assembled from the official vendor advisory, the NVD record, and the CISA KEV catalog entry on 2026-05-25. Always confirm against the vendor advisory before applying changes in production.

Related fixes

Nearby vulnerabilities you may as well remediate alongside this fix:

• How to Fix CVE-2022-30190: Remote Code Execution in Windows 10 Version 1809
• How to Fix CVE-2022-41033: Access of Resource Using Incompatible Type ('Type Confusion')
• How to Fix CVE-2022-44698: Security Vulnerability in Windows 10 Version 1809
• How to Fix CVE-2022-41082: Deserialization of Untrusted Data
• How to Fix CVE-2022-21882: Out-of-bounds write in Microsoft Windows