Join our Newsletter — 33% off our NHI Course

CVE-2023-36584 (Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass)

CVE-2023-36584 is a mark of the web (MOTW) security feature bypass vulnerability in Microsoft Windows. CISA added it to the Known Exploited Vulnerabilities catalogue on 16 November 2023, which means attackers have used it in real attacks. Organisations running the affected product should apply the vendor fix or mitigation as a priority.

What this vulnerability class means

Mark of the Web, or MOTW, is a Windows trust signal attached to files that originate from outside the local machine, often from the internet, email, or downloaded archives. A bypass in this feature matters because Windows may treat a risky file as if it came from a trusted source, which can weaken built-in warnings and related protections.

The issue is not that MOTW is a standalone security boundary, but that many Windows controls, user prompts, and workflow decisions depend on it. When that trust marker is bypassed, malicious content can move further into the endpoint execution path before the user or security tooling gets the chance to stop it.

Why it is dangerous on Windows endpoints

A MOTW bypass can reduce the friction that normally interrupts a dangerous download or attachment. That makes it especially valuable to attackers who rely on a user opening a document, script, shortcut, or archive that would otherwise trigger a warning or a protected-view style safety step.

For defenders, the danger is broader than one file. Once a file is handled as trusted, it can be unpacked, executed, or chained into other activity more easily, which raises the chance of initial compromise, follow-on payload delivery, and local execution on the endpoint.

See the NIST National Vulnerability Database and the CVE Program for authoritative record details and vulnerability tracking.

How organisations check exposure and reduce it

Exposure review starts with endpoint inventory, Windows version coverage, and identifying where users regularly handle internet-origin files. Organisations should also look at mail gateways, browser download paths, shared drives, remote work patterns, and any business process that routinely moves content from untrusted sources into Windows workstations.

Because the primary mitigation is vendor-directed, teams should follow Microsoft guidance and prioritise patching or the documented workaround from the product advisory rather than relying on a generic file-blocking assumption. That is especially important where high-risk users, developers, finance teams, or administrators routinely open externally sourced content.

Windows Endpoint Hardening Guide and the Endpoint Hardening Checklist are useful references for reducing the attack surface around Windows workstations. The broader Vulnerability Management Guide helps teams prioritise KEV-listed issues like this one.

Detection, response, and post-patch review

Detection should focus on signs that a file arrived from the internet but no longer carries the expected trust metadata, or that a suspicious file executed after download with fewer user-facing warnings than normal. Security teams should also review endpoint, email, browser, and process telemetry for evidence of file delivery, script launch, archive extraction, or secondary payload execution.

If exploitation is suspected, the response should include a review of the original file path, adjacent downloads, and any process tree that followed the initial open action. After patching, organisations should still inspect for compromise indicators, because a feature bypass can be used as the delivery step for a broader intrusion rather than as the end goal itself.

Windows Event Log Guide supports the hunt for file-open and execution artefacts, while Web Application Attacks Guide is a useful reminder that initial delivery methods often matter as much as the payload itself.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework Control / Reference Relevance
CIS Controls v8 CIS-5 — Account Management Windows exposure management depends on timely asset and vulnerability control.
Recommendation — Prioritise KEV-listed Windows fixes and verify exposed endpoints are covered by patch governance.
NIST SP 800-53 Rev 5 SI-2 — Flaw Remediation A MOTW bypass is a software flaw that requires remediation tracking and verification.
SI-3 — Malicious Code Protection Bypass of file trust signals affects how malicious content reaches execution.
AU-6 — Audit Record Review, Analysis, and Reporting Post-exploitation review depends on endpoint and execution telemetry.
Recommendation — Track the flaw to remediation and confirm the fix is deployed across affected systems. Strengthen malicious content controls for files that originate outside the local system. Review logs for file delivery, execution, and follow-on activity tied to the initial download.
ISO/IEC 27001:2022 A.8.8 — Management of technical vulnerabilities MOTW bypass exposure is managed as a technical vulnerability in Windows endpoints.
Recommendation — Maintain a vulnerability process that tracks and remediates exploited Windows flaws promptly.