How to Fix CVE-2023-24880: Windows SmartScreen Security Feature Bypass

By the Sai Kiran Pandrala · Reviewed and edited by Sai Kiran Pandrala, Editor

Patch immediately. CISA's Known Exploited Vulnerabilities catalog lists this CVE, which means active exploitation has been confirmed. CISA KEV entry added 2023-03-14, federal due date 2023-04-04.

What is CVE-2023-24880?

CVE-2023-24880 is a security feature bypass in Windows SmartScreen, the reputation check built into Windows and Microsoft Edge that warns you before you run files downloaded from the internet. Microsoft titles it the “Windows SmartScreen Security Feature Bypass Vulnerability” and classifies the weakness as CWE-863, Incorrect Authorization. In plain terms, an attacker crafts a file in a way that makes SmartScreen apply the wrong trust decision, so the “this file came from the internet” Mark-of-the-Web (MOTW) prompt that normally fires for an unknown download never appears.

The bug lives in the operating system itself, not in any single app. Specifically, a malformed Authenticode signature on a file confuses SmartScreen’s MOTW evaluation, and the SmartScreen warning is silently skipped. The user still has to open the file for anything to happen, which is why this is a bypass and not remote code execution. But removing that one warning is exactly what an opportunistic malware operator wants, because the warning is often the last thing standing between a careless click and a running payload.

This is a local, user-interaction-required flaw. The CVSS 3.1 base score is 4.4 (Medium) with the vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L. The score is modest on paper, yet CISA placed it on the Known Exploited Vulnerabilities catalog the same day Microsoft published the fix, because it was being weaponized in real campaigns. A low base score plus confirmed in-the-wild abuse is precisely the combination that gets a CVE prioritized in mature patch programs.

Why this CVE matters

SmartScreen is a safety net, and this vulnerability quietly cuts a hole in it. When the MOTW warning is suppressed, a user who downloads a booby-trapped file gets no friction at all. According to Microsoft and reporting from Google’s Threat Analysis Group, the technique was used to deliver Magniber ransomware: the malicious payloads carried a deliberately malformed signature so SmartScreen would wave them through without a peep.

That is why a 4.4 Medium deserves emergency treatment here. The number reflects technical impact in isolation; it does not capture the fact that real ransomware crews built tooling around this exact bypass. CISA’s SSVC assessment in the record marks exploitation as Active, automatable as no (a human still has to open the file), and technical impact as partial. If you run any unpatched Windows build from the affected list, you should assume someone is already trying this against your users.

Am I affected?

You are affected if you run a Windows client or server build older than its March 14, 2023 cumulative update. The flaw spans a wide range of supported Windows versions. Check your current OS build with either of the commands below and compare it against the fixed builds in the table.

# Show your exact Windows build (run in PowerShell or cmd)
[System.Environment]::OSVersion.Version
# Or, the human-readable build string:
(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').CurrentBuildNumber + '.' + (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').UBR

REM Quick build check from cmd.exe
winver
REM or, for the full build with revision:
systeminfo | findstr /B /C:"OS Version"

The UBR value is the revision number after the build number. For example, on Windows 11 22H2 a build of 22621.1413 or higher is patched; 22621.1265 is not. Map your version to the fixed build:

• Windows 10 1607 / Windows Server 2016: fixed at build 10.0.14393.5786
• Windows 10 1809 / Windows Server 2019: fixed at build 10.0.17763.4131
• Windows 10 20H2: fixed at build 10.0.19042.2728
• Windows 10 21H2: fixed at build 10.0.19044.2728
• Windows 10 22H2: fixed at build 10.0.19045.2728
• Windows 11 21H2: fixed at build 10.0.22000.1696
• Windows 11 22H2: fixed at build 10.0.22621.1413
• Windows Server 2022: fixed at build 10.0.20348.1607

If your installed build number is below the value listed for your version, the SmartScreen bypass is live on that machine and you need the patch.

How to fix CVE-2023-24880

The fix is the March 14, 2023 Patch Tuesday cumulative update for your Windows version. There is no standalone hotfix and no registry toggle that closes the hole. Microsoft corrected SmartScreen’s signature handling inside the monthly quality update, so once that cumulative update is installed, the patched build numbers above are reached and the bypass is gone. Because Windows cumulative updates are itemized by build rather than by a single KB, the exact KB article you need depends on your version; look it up on the Microsoft Security Update Guide entry for CVE-2023-24880. For the most common versions the March 2023 KBs were KB5023696 (Windows 10 22H2/21H2/20H2 family), KB5023702 (Windows 11 22H2), and the corresponding cumulative updates for Server 2016/2019/2022.

Option 1: Windows Update (single machine)

For one PC or a handful of them, just take the monthly update. Open Settings → Windows Update, click Check for updates, install everything offered, and reboot. The March 2023 (or any later) cumulative update brings you to a patched build, because Windows cumulative updates are cumulative: a current machine already contains this fix.

# Trigger a scan and install via the built-in Windows Update agent (admin PowerShell)
UsoClient StartScan
UsoClient StartDownload
UsoClient StartInstall
# Then reboot when prompted:
shutdown /r /t 60

Option 2: WSUS / SCCM / Configuration Manager (fleet)

In a managed environment, approve the March 2023 (or later) cumulative update for the relevant product families in WSUS, or deploy it as a software update group in Microsoft Configuration Manager (SCCM). Target the device collections that match the affected versions, set a deadline, and let the client agent install at the next maintenance window. Because the fix is folded into the monthly rollup, any deployment ring already current on Patch Tuesday updates is covered.

Option 3: Microsoft Update Catalog (offline / air-gapped)

For machines that cannot reach Windows Update, download the standalone .msu for your exact build and KB from the Microsoft Update Catalog, then install it with wusa:

# Install a cumulative update package downloaded from the Microsoft Update Catalog
# (replace the filename with the .msu that matches your version and architecture)
wusa.exe C:\Patches\windows10.0-kb5023696-x64.msu /quiet /norestart
shutdown /r /t 60

Reboot is mandatory. The new build number is not in effect until the machine restarts and finishes the post-reboot servicing phase.

If you can't patch immediately

There is no supported configuration switch that disables only the vulnerable code path, so the cumulative update is the real fix. Until you can install it, reduce the chance a user ever opens a SmartScreen-bypassing file:

• Keep SmartScreen on everywhere it exists. Confirm SmartScreen for apps and files, and the Microsoft Edge / Defender SmartScreen settings, are enabled via Windows Security or Group Policy. The bypass is bad; SmartScreen fully disabled is worse.
• Block the delivery vector. These campaigns arrived as downloaded files. Use email filtering, web filtering, and attachment policies to strip or quarantine risky file types (signed executables and disk images from untrusted senders) before they reach users.
• Lean on Defender / your EDR. Microsoft Defender and most EDR products detect the Magniber payloads independently of the SmartScreen verdict. Make sure real-time protection and cloud-delivered protection are on and signatures are current.
• Apply attack surface reduction (ASR) rules that block executable content from email and webmail, which removes a common path for these files entirely.

None of these remove the vulnerability. They only narrow the window while you schedule the cumulative update, which remains mandatory.

How to verify the fix worked

After patching and rebooting, confirm the build number meets or exceeds the fixed build for your version:

# Read the current build and update revision (UBR)
$cv = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
"$($cv.CurrentMajorVersionNumber).$($cv.CurrentMinorVersionNumber).$($cv.CurrentBuildNumber).$($cv.UBR)"
# Compare against the fixed build for your Windows version (see the list above)

You can also confirm the specific cumulative update is present:

# List recently installed quality updates (newest first)
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID, InstalledOn
# Or check for a specific KB, e.g. the March 2023 rollup:
Get-HotFix -Id KB5023696 -ErrorAction SilentlyContinue

Finally, run an authenticated vulnerability scan with current content and confirm the scanner no longer flags CVE-2023-24880 on the host. If a user already opened a file that slipped past SmartScreen during the unpatched window, treat that machine as suspect: isolate it, run a full Microsoft Defender or EDR scan, review the process tree and any new scheduled tasks or services, and rotate credentials entered on that device.

Frequently asked questions

What does CVE-2023-24880 actually let an attacker do?

It lets a crafted file bypass Windows SmartScreen and the Mark-of-the-Web warning, so opening a malicious download produces no “this file came from the internet” prompt. The user still has to run the file, which is why the CVSS base score is only 4.4 (Medium) and requires user interaction. In the wild it was used to deliver Magniber ransomware without a SmartScreen warning.

Which KB or Windows build fixes CVE-2023-24880?

The March 14, 2023 cumulative update for your version. Windows 10 1809 and Server 2019 reach 10.0.17763.4131; Server 2022 reaches 10.0.20348.1607; Windows 10 20H2/21H2/22H2 reach 10.0.19042.2728 / 10.0.19044.2728 / 10.0.19045.2728; Windows 11 21H2 reaches 10.0.22000.1696; Windows 11 22H2 reaches 10.0.22621.1413; and Windows 10 1607 / Server 2016 reach 10.0.14393.5786. Common KBs were KB5023696 and KB5023702. Confirm the exact KB for your build on the Microsoft advisory.

Is there a fix for Linux, apt, or yum for CVE-2023-24880?

No. This is a flaw in the Windows SmartScreen component of the Windows operating system. It has nothing to do with Linux, apt, dnf, yum, or container images. The only fix is the monthly Windows quality update delivered through Windows Update, WSUS, SCCM/Configuration Manager, or the Microsoft Update Catalog.

Is CVE-2023-24880 being exploited in the wild?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 2023-03-14, and CISA’s SSVC assessment marks exploitation as Active. Microsoft and Google’s Threat Analysis Group reported it being abused to bypass SmartScreen and deliver Magniber ransomware.

If a user already opened a file that bypassed SmartScreen, what should I do?

Treat that host as potentially compromised. Isolate it, run a full Microsoft Defender or EDR scan, review what the user ran and any child processes, check for new scheduled tasks, services, or persistence, and rotate any credentials entered on that machine. Then confirm the March 2023 cumulative update is installed so the bypass can no longer happen.

References

• Official vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24880
• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2023-24880
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CISA KEV record: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-24880
• Additional reference: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-24880

This guide was assembled from the official vendor advisory, the NVD record, and the CISA KEV catalog entry on 2026-05-25. Always confirm against the vendor advisory before applying changes in production.

Related fixes

Additional nearby issues sensible to fix in the same maintenance window:

• How to Fix CVE-2023-36802: Use After Free in Windows 10 Version 1809
• How to Fix CVE-2023-41763: Server-Side Request Forgery (SSRF) in Skype For Business Server 2015 Cu13
• How to Fix CVE-2023-23376: Heap-based Buffer Overflow in Windows 10 Version 1809
• How to Fix CVE-2023-36761: Improper Input Validation in Microsoft Office 2019
• How to Fix CVE-2023-29336: Use After Free in Windows 10 Version 1507