Loading vulnerability…
Windows SmartScreen Security Feature Bypass
CVE-2024-21351 is a Windows SmartScreen security feature bypass vulnerability affecting Microsoft Windows. The flaw allows an attacker to circumvent SmartScreen protections when a user opens attacker-supplied content. Available reporting indicates the issue can permit code injection into SmartScreen, thereby bypassing trust and warning mechanisms intended to protect users from untrusted internet-originated files. Microsoft reported the vulnerability as exploited in the wild at the time of disclosure.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an attacker to bypass Windows SmartScreen security checks and reduce or eliminate warning prompts that would normally be presented for untrusted content. This can facilitate subsequent payload execution and may lead to arbitrary code execution, exposure of data, or loss of availability, depending on the follow-on payload and user context. The vulnerability has been reported as actively exploited in real-world attacks.
If you can’t patch tonight, do this now.
Until patches are fully deployed, reduce exposure by limiting execution of untrusted files from external sources, enforcing application control policies, restricting delivery paths commonly used for user-opened malicious files, and strengthening user protections around internet-originated content. Additional defensive measures such as attachment filtering, web download controls, and least-privilege user operation can reduce the likelihood and impact of exploitation, but they do not replace vendor patching.
Patch, then assume compromise.
Apply Microsoft's February 2024 security updates for affected Windows systems. Organizations should prioritize patching because the vulnerability was added to CISA's Known Exploited Vulnerabilities catalog and was reported as under active exploitation.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.