CVE-2026-108463: Windows SmartScreen Security Feature Bypass Vulnerability
Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network.
Other sources
Windows SmartScreen Security Feature Bypass Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26200.9711Patch KB5127648 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26300.9711Patch KB5127648 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.9711Patch KB5127648 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.28000.3231Patch KB5127646
Event History
Frequently Asked Questions
Does an attacker need credentials or local access to attempt exploitation?
No credentials are required according to the supplied vector, and the attack vector is network-based. The attacker would still need user interaction.
What is the potential impact if the bypass is successfully exploited?
The supplied CVSS vector rates confidentiality, integrity, and availability impact as high. Scope is listed as unchanged.
Which software should be assessed for exposure?
The affected software list identifies Microsoft Windows 11 and Microsoft Windows SmartScreen.
Is public exploit availability established by the supplied data?
No. The supplied vector marks exploit code maturity as unproven.