Yes. CISA added CVE-2023-24880 to its Known Exploited Vulnerabilities catalogue on 14 March 2023, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.
How to verify this CVE is actively exploited
The fastest confirmation path is to treat CISA KEV as the operational source of truth for exploitation status, then use the vendor advisory for technical context. For CVE-2023-24880, the practical question is not whether the flaw exists, but whether your Windows fleet can still receive or launch a file that bypasses Mark of the Web checks and whether that path is exposed anywhere users handle untrusted content.
When a vulnerability is already in KEV, the response should move from speculative risk review to exposure validation. The key operational task is to identify where SmartScreen, downloaded files, email attachments, browser downloads, and archive handling could still permit the bypass condition, then prioritize endpoints most likely to receive externally sourced files.
- CISA Known Exploited Vulnerabilities Catalog is the right place to verify exploitation status and CISA’s required action.
- NIST National Vulnerability Database helps with record lookups and downstream tracking, but KEV should drive urgency.
- CVE Program is useful for canonical vulnerability identification when you are reconciling ticketing or asset records.
Why this bypass matters on Windows endpoints
SmartScreen and Mark of the Web are meant to add a trust boundary around downloaded files, especially when users open content from email, chat, web downloads, or shared drives. A security feature bypass weakens that boundary, so the realistic impact is not just one blocked warning disappearing, but a higher chance that malicious content reaches execution or user interaction steps that defenders assumed were gated.
The practical consequence is that endpoint controls can look healthy while the user-facing trust signal has been degraded. That matters most in environments where attackers rely on social engineering, staged payloads, or living-off-the-land execution after a file is opened.
What to do if patching or mitigation is delayed
If patching cannot happen immediately, reduce the number of places where the bypass can be exercised and narrow who can launch untrusted content. That usually means tightening download handling, attachment detonation, application control, and browser-to-endpoint transfer paths, then watching for file-origin indicators and suspicious child-process activity on Windows systems.
For this class of issue, earlier compromise checks should focus on the time window before remediation, because exploitation may not leave an obvious alert. Review recent downloads, unusual archive extraction, unexpected script or shortcut execution, and endpoint telemetry around user-launched files from external sources.
- Zero-Day and Exploited Vulnerabilities Guide covers KEV-driven triage, emergency mitigation, and post-patch hunting for exploited flaws.
- Windows Endpoint Hardening Guide is useful when you need to pair remediation with baselines, exploit protection, and Windows-specific guardrails.
- Windows Event Log Guide helps teams validate whether suspicious file execution or logon activity occurred before the fix.
Risk and Threat Considerations
A SmartScreen bypass is risky because it attacks a trust layer that users and defenders often treat as a reliable warning boundary. In ransomware and initial-access workflows, that kind of weakness is valuable because it can turn an otherwise suspicious download into a more convincing execution path.
Failure mechanism: Malicious files can evade the Mark of the Web trust signal, so the user may not get the protection or friction defenders expect before opening content.
Impact: The bypass can increase the likelihood of payload execution, credential theft, or a follow-on compromise path that starts with a simple file delivery step.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST CSF 2.0, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | KEV-listed flaws require prioritized exposure tracking and remediation. |
| Recommendation — Track and remediate KEV-listed endpoints first, then verify closure with rescans. | ||
| NIST CSF 2.0 | ID.RA-01 — Asset Vulnerabilities Are Identified and Managed | This CVE is about validating exposure to a known exploited weakness. |
| Recommendation — Identify exposed Windows assets and prioritize remediation of the bypass. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | Active exploitation makes timely flaw remediation the central control need. |
| AU-6 — Audit Review, Analysis, and Reporting | Post-exploitation review depends on reviewing endpoint and file-activity telemetry. | |
| Recommendation — Patch or mitigate the SmartScreen bypass and verify completion. Review logs for suspicious file execution and pre-remediation activity. | ||
| OWASP ASVS | V16 — Security Logging and Error Handling | When patching lags, detection and investigation depend on reliable logging. |
| Recommendation — Ensure endpoint and application logs capture suspicious download-to-execution activity. | ||
Practitioner Guidance
What to verify: Confirm that your remediation plan covers every endpoint class that handles internet-originated files, not just standard workstations. If users can download and open files locally, the exposure exists even when browser and email controls are otherwise strong.
Decision rule: If you cannot patch immediately, treat the issue as a containment problem first, and validate whether file execution controls, attachment inspection, and download monitoring can reduce exposure until the fix is in place.
Practitioner takeaway: For a KEV-listed Windows bypass, the important judgment is whether your environment can still be tricked into trusting an untrusted file, because that is what turns a disclosure into a real compromise path.
Related resources from NHI Mgmt Group
- Is CVE-2023-32049 (Microsoft Windows Defender SmartScreen Security Feature Bypass) being exploited in the wild?
- Is CVE-2024-21351 (Microsoft Windows SmartScreen Security Feature Bypass) being exploited in the wild?
- CVE-2023-24880 (Microsoft Windows SmartScreen Security Feature Bypass)
- How do you patch or mitigate CVE-2023-32049 (Microsoft Windows Defender SmartScreen Security Feature Bypass)?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org