Is CVE-2022-44698 (Microsoft Defender SmartScreen Security Feature Bypass) being exploited in the wild?

What the Exploitation Signal Means for This CVE

This CVE is not just a theoretical Microsoft Defender SmartScreen flaw. CISA’s KEV listing means defenders should treat it as actively used in real attack chains, with ransomware relevance raising the urgency for internet-facing and user-facing Windows environments. The practical question is less “can it be exploited?” and more “where could a malicious file still reach a user before controls block it?”

Because the issue is a security feature bypass, the attacker goal is often to defeat a trust signal rather than trigger an obvious crash. That makes exposure more about delivery paths, file handling, and user interaction than about a single vulnerable service endpoint.

How SmartScreen Bypass Changes the Attack Path

SmartScreen is designed to warn on or hinder suspicious files, especially when Mark of the Web is present. A bypass weakens that protection layer, so a file that would normally face extra scrutiny may be able to execute or progress further in the intrusion chain. That shifts attention to initial access methods, file provenance, and whether users can still launch downloaded content with reduced friction.

For defenders, the important consequence is that a bypass can support phishing, malicious attachment delivery, drive-by download follow-up, or post-compromise execution. If the environment depends heavily on SmartScreen as a boundary, the control assumption is weaker than it looks, and layered controls need to absorb more of the burden.

What to Check Before and After Remediation

Start by confirming whether affected Windows endpoints and virtual desktops are actually exposed to the delivery conditions that make this CVE useful to an attacker. Focus on systems where users routinely open downloaded files, receive externally sourced archives, or handle email attachments and collaboration content.

Then look for earlier compromise rather than assuming the issue is clean once patching begins. Review user execution events, downloaded-file activity, suspicious child processes, browser download history, email attachment handling, and any alerts that suggest a file entered the environment through a trusted channel but executed unexpectedly. If you have telemetry that records blocked or permitted file launches, retain it for correlation and scoping.

Risk and Threat Considerations

When a security feature bypass is being exploited in the wild, the main risk is not only execution of a malicious file, but loss of confidence in a control that users and analysts may treat as a warning boundary. That can shorten the attacker’s path from delivery to execution and make social engineering more effective.

Failure mechanism: The attacker uses a specially crafted file to evade Mark of the Web related defenses, reducing the likelihood that SmartScreen interrupts or discourages execution. Once the trust signal is weakened, downstream payload delivery, credential theft, or ransomware staging becomes easier to complete.

Impact: End users are more likely to open and run malicious content, and defenders may lose an early detection opportunity. In environments where file trust prompts are a meaningful part of the control stack, that can increase the blast radius of phishing and malware campaigns.

Practitioner Guidance

What to prioritise: Treat the KEV listing as a triage signal, not a background note. Prioritise endpoints that frequently receive external files, because they are most likely to be used in a practical exploitation path.

What to verify: Confirm patch status and then verify whether users still have alternative ways to launch untrusted content, such as archives, scripts, mounted images, or other file types that can preserve attacker reach even when one control is fixed. Use CISA Known Exploited Vulnerabilities Catalog for authoritative exploitation status and remediation tracking.

Decision rule: If patching is delayed, reduce exposure by tightening file handling paths, limiting user execution of downloaded content, and increasing monitoring around suspicious downloads and launches rather than relying on SmartScreen alone.

Practitioner takeaway: For an exploited feature-bypass CVE, the real security question is whether your environment still lets an attacker turn a trusted-looking file into execution before other controls intervene.

Related resources from NHI Mgmt Group

• Is CVE-2023-32049 (Microsoft Windows Defender SmartScreen Security Feature Bypass) being exploited in the wild?
• How do you patch or mitigate CVE-2022-44698 (Microsoft Defender SmartScreen Security Feature Bypass)?
• CVE-2022-44698 (Microsoft Defender SmartScreen Security Feature Bypass)
• How do you patch or mitigate CVE-2023-32049 (Microsoft Windows Defender SmartScreen Security Feature Bypass)?