CVE-2022-41091

Exploited in the wild. In CISA KEV since 2022‑11‑08. Fixed versions are out.

CVSS 3.15.4Medium EPSS percentile80th1.9% chance in 30 days CISA KEVListedsince 2022-11-08, due 2022-12-09
No public exploit known Fix5 products7 fixed builds listed below

Published 2022-11-09Updated 2026-08-10Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Microsoft Windows 10 Version 1507Affected: ≥ 10.0.10240.0, < 10.0.10240.19567Upgrade to: 10.0.10240.19567Affected: ≥ 10.0.14393.0, < 10.0.14393.5501Upgrade to: 10.0.14393.5501Affected: ≥ 10.0.17763.0, < 10.0.17763.3650Upgrade to: 10.0.17763.3650Affected: ≥ 10.0.0, < 10.0.19042.2251Upgrade to: 10.0.19042.2251 + 3 more branchesStated by: CVE record
Microsoft Windows 11 version 21H2Affected: ≥ 10.0.0, < 10.0.22000.1219Upgrade to: 10.0.22000.1219Affected: ≥ 10.0.22621.0, < 10.0.22621.819Upgrade to: 10.0.22621.819Stated by: CVE record
Microsoft Windows Server 2016Affected: ≥ 10.0.14393.0, < 10.0.14393.5501Upgrade to: 10.0.14393.5501Stated by: CVE record
Microsoft Windows Server 2019Affected: ≥ 10.0.17763.0, < 10.0.17763.3650Upgrade to: 10.0.17763.3650Stated by: CVE record
Microsoft Windows Server 2022Affected: ≥ 10.0.20348.0, < 10.0.20348.1249Upgrade to: 10.0.20348.1249Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether any of your machines are running Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022, or Windows Server 2022 Datacenter: Azure Edition.
On each affected device, install the Microsoft update(s) that fix CVE-2022-41091 according to your Windows version (use the Microsoft Update Guide for your exact build).
Confirm the system updates completed successfully and that the device reboots into the updated version.
For servers and endpoints that can’t be updated right away, restrict access to the ways users can download and open files from the internet until patching is completed (per your IT team’s standard hardening).

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

Coverage timeline

0 publishers

Added to CISA KEV catalog
Nov 8, 2022·CISA KEV

Sourced from public security reporting — each date is when it was published, not when it happened.

What it is

From the CVE record

Windows Mark of the Web Security Feature Bypass Vulnerability

In plain language

Written by AI from the record

This Windows flaw can let malware ignore a browser warning meant to protect your PC, so if you run a typical Windows 10/11 or Windows Server, you should act now—CISA says it’s been used in ransomware.

CVE-2022-41091 is a Windows Mark of the Web Security Feature Bypass Vulnerability (CWE-863) where attackers can bypass protections intended to mark downloaded web content as untrusted, enabling malicious files to be treated more safely by Windows; it is listed in CISA KEV for use in ransomware campaigns.

If you're affected

Ransomware entry via malicious downloads
Malware bypass of Windows file checks
Business disruption from encryption
Service downtime and recovery costs

What is it

Windows uses a “trust marking” feature to help decide whether a downloaded file should be treated as untrusted. This vulnerability allows that protection to be bypassed, making it easier for malicious files to run their intended behavior. Think of it like a shipping label that’s supposed to warn “untrusted package”—this flaw can let the warning be ignored.

Who is affected

This matters if you run Windows 10, Windows 11, or any of the listed Windows Server versions (including Windows Server 2022 Datacenter: Azure Edition), because those systems include the Mark of the Web security feature. CISA says it was used in ransomware campaigns, so treat it as a real, practical threat when the vulnerable system can be reached and users can download/open content from the internet. In particular, risk is tied to getting malicious downloaded content onto the device and having it opened/executed.

How urgent is it

This is RED because it’s confirmed in CISA KEV as used in ransomware campaigns. Attackers can bypass a Windows trust safeguard, which makes successful infection more likely when users encounter malicious downloads. You should prioritize patching on all affected Windows endpoints and servers as soon as possible.

What to do — in detail

Confirm scope (find affected builds)
- Inventory all endpoints and servers running: Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2022 Datacenter: Azure Edition.
- For each device, identify the exact Windows version/build so you apply the correct fixed update.
Apply the correct Microsoft fixes
- Use Microsoft’s CVE-specific update guidance: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41091
- Install the update(s) that correspond to your platform’s fixed version. The finding lists these “fixed in” targets:
  - Windows 10 fixes in:
    - 10.0.10240.19567
    - 10.0.14393.5501
    - 10.0.17763.3650
    - 10.0.19042.2251
    - 10.0.19043.2251
    - 10.0.19044.2251
    - 10.0.19045.2251
  - Windows 11 fixes in:
    - 10.0.22000.1219
    - 10.0.22621.819
  - Windows Server 2016 fix in:
    - 10.0.14393.5501
  - Windows Server 2019 fix in:
    - 10.0.17763.3650
  - Windows Server 2022 fix in:
    - 10.0.20348.1249
Verify after patching
- Ensure each device successfully installs updates and reboots if required.
- Re-check the device version/build to confirm it matches or is above the listed fixed target for that OS branch.
If patching is delayed (temporary containment)
- Reduce the chance of malicious “downloaded content” being opened by users: tighten download permissions, limit risky file types from the internet, and ensure browser/endpoint controls are enforcing your organization’s standard safe-download and execution restrictions.
- Prioritize patching for systems that are most exposed to internet-borne content (user workstations) before lower-traffic systems.
What to monitor
- Look for signs of ransomware activity and suspicious execution shortly after downloads (unexpected new scheduled tasks/services, unusual process chains, or file-encryption behavior). Focus especially on devices where updates could not be applied immediately.

CISA timing note

KEV entry required remediation with a due date of 2022-12-09. Even though that date has passed, this should still drive urgent remediation now.

Technical context

Severity/priority: Traffic-light verdict is RED. The issue is in the Windows Mark of the Web Security Feature Bypass area (CWE-863), meaning the attacker can bypass a protection related to trust marking of downloaded content.

Exploit status: Confirmed exploitation—this CVE is listed in CISA’s KEV and was used in ransomware campaigns (KEV added 2022-11-08). Per the findings, there is no public exploit code recorded, but KEV still indicates real-world attacker use.

Attack vector (high level): Attackers leverage the bypass of Windows’ Mark of the Web trust handling so malicious files downloaded from the internet can be treated more permissively, increasing the chance of successful malware execution.

EPSS note: EPSS is a prediction (trend falling). Because KEV confirms exploitation, the public-facing priority is driven by KEV, not the prediction.

What KEV means here: CISA’s KEV catalog flags vulnerabilities that have been observed as actively exploited; that is why this is treated as urgent across the affected Windows versions.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS80th

CISA KEV

Listed as exploited in the wild since 2022-11-08.

US federal agencies must remediate by 2022-12-09.

Known use in ransomware campaigns.

Apply updates per vendor instructions.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

1.9% chance of exploitation activity in the next 30 days, which ranks it in the 80th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

9 events over 1371 days, from the signal feeds we watch.

2026-08-10Patch availablerecord updated
2026-06-25OpenVAS check added
2025-10-30Patch availablerecord updated
2022-11-09Publishedweakness classified, att&ck mapped
2022-11-08Added to CISA KEVransomware campaign

Affected products

Microsoft Corpcommercial · USaka Microsoft, microsoft corporation

And 36 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Scored 5.4 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action