CVE-2026-108463: Windows SmartScreen Security Feature Bypass Vulnerability
Published Oct 13, 2026
·Updated
Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network.
Other sources
Windows SmartScreen Security Feature Bypass Vulnerability
— Microsoft
Affected Software
25 affected componentsFixes available
Microsoft Windows SmartScreen
Microsoft Windows 11=24H2
10.0.26100.9711
Microsoft Windows 11=24H2
10.0.26100.9711
Microsoft Windows 11=26H1
10.0.28000.3231
Microsoft Windows 11=26H1
10.0.28000.3231
Microsoft Windows 11=25H2
10.0.26200.9711
Microsoft Windows 11=26H2
10.0.26300.9711
Microsoft Windows 11=26H2
10.0.26300.9711
Microsoft Windows 11=25H2
10.0.26200.9711
Microsoft Windows 11 24h2<10.0.26100.9711
Microsoft Windows 11 24h2<10.0.26100.9711
Microsoft Windows 11 25h2<10.0.26200.9711
Microsoft Windows 11 25h2<10.0.26200.9711
Microsoft Windows 11 26h1<10.0.28000.3231
Microsoft Windows 11 26h1<10.0.28000.3231
Microsoft Windows 11 26h2<10.0.26300.9711
Microsoft Windows 11 26h2<10.0.26300.9711
Microsoft Windows 11=24H2, >=10.0.26100<10.0.26100.9711
10.0.26100.9711
Microsoft Windows 11=24H2, >=10.0.26100<10.0.26100.9711
10.0.26100.9711
Microsoft Windows 11=26H1, >=10.0.28000<10.0.28000.3231
10.0.28000.3231
Microsoft Windows 11=26H1, >=10.0.28000<10.0.28000.3231
10.0.28000.3231
Microsoft Windows 11=25H2, >=10.0.26200<10.0.26200.9711
10.0.26200.9711
Microsoft Windows 11=25H2, >=10.0.26200<10.0.26200.9711
10.0.26200.9711
Microsoft Windows 11=26H2, >=10.0.26300<10.0.26300.9711
10.0.26300.9711
Microsoft Windows 11=26H2, >=10.0.26300<10.0.26300.9711
10.0.26300.9711
Remediation
Event History
Oct 13, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·02:00 PM
Affected Software
CVE Published
via MITRE·07:01 PM
Data Sourced
via MITRE·07:01 PM
DescriptionSeverity
Data Sourced
via NVD·07:18 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Does an attacker need credentials or local access to attempt exploitation?
No credentials are required according to the supplied vector, and the attack vector is network-based. The attacker would still need user interaction.
2
What is the potential impact if the bypass is successfully exploited?
The supplied CVSS vector rates confidentiality, integrity, and availability impact as high. Scope is listed as unchanged.
3
Which software should be assessed for exposure?
The affected software list identifies Microsoft Windows 11 and Microsoft Windows SmartScreen.
4
Is public exploit availability established by the supplied data?
No. The supplied vector marks exploit code maturity as unproven.