Microsoft Windows SmartScreen: Security feature bypass via path equivalence
Summary
Windows SmartScreen, the Windows feature that blocks phishing sites and untrusted downloads, contains an improper resolution of path equivalence flaw (CWE-41). A remote, unauthenticated attacker can bypass this security feature over the network, but user interaction is required, for example by opening a crafted file or link. The CVSS vector rates the impact on confidentiality, integrity and availability as high.
Affected
- Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9711
- Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9711
- Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3231
- Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9711
- The NVD CPE data lists only 24H2. Windows 10: no entries found.
Fixed in
- Windows 11 24H2: build 10.0.26100.9711 (KB5127648, not verified)
- Windows 11 25H2: build 10.0.26200.9711 (KB5127648, not verified)
- Windows 11 26H1: build 10.0.28000.3231 (KB5127646, not verified)
- Windows 11 26H2: build 10.0.26300.9711 (KB5127648, not verified)
- Verify the KB numbers and release date against the MSRC Security Update Guide, as sources conflict on the release date (13 or 14 October 2026).
Workaround
Unknown. No vendor-published workaround was found. Check the MSRC FAQ and mitigations section.
Exploitation
- No evidence of in-the-wild exploitation was found.
- No public proof of concept was found.
- CISA SSVC assessment: Exploitation none, Automatable no, Technical Impact total.
- EPSS is about 0.88 %.
- The CISA KEV catalog should be checked directly.
Our recommendation
- Install the October 2026 security update on all affected Windows 11 systems as part of standard Patch Tuesday deployment.
- Confirm on endpoints that the fixed build is reported.
- Keep SmartScreen enabled and filter email and web downloads.
- Verify affected versions and KB numbers in the MSRC advisory before creating change tickets.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide: CVE-2026-108463 msrc.microsoft.com
- NVD-mirrored record (Vulners) vulners.com
- Vulnrichment record (Vulners) vulners.com
- threatint CVE record cve.threatint.com
- Strix CVE entry www.strix.ai
- GitHub alert (EPSS and KEV status, automated feed) github.com
- EUVD listing (Vulners) vulners.com
- HKCERT security bulletin, October 2026 www.hkcert.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 19:07.
Original description (NVD)
Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.