Windows SmartScreen CVE-2026-108463

Requires user interaction (CVSS UI:R): the victim must download and open an attacker-crafted file whose path-equivalence form (CWE-41) causes Windows SmartScreen to fail to apply its Mark-of-the-Web reputation check, so the file executes without the expected warning. No authentication or prior privileges are needed (PR:N). Limiting factors: exploitation depends on social-engineering the user into opening the crafted content, SmartScreen must be the relied-upon control, and only unpatched Windows 11 builds are affected - 24H2 before 10.0.26100.9711, 25H2 before 10.0.26200.9711, 26H1 before 10.0.28000.3231, and 26H2 before 10.0.26300.9711. SSVC marks it not automatable, so mass automated exploitation is unlikely.

Signals conflict on urgency. Microsoft's CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) rates this high because successful exploitation yields total confidentiality/integrity/availability loss, and SSVC confirms 'Technical Impact: total.' However, the same SSVC record says Exploitation: none and Automatable: no, and there is no CISA KEV listing and no public exploit identified at time of analysis - so there is no evidence of real-world weaponization yet. Note a material tension: the CVSS impact triad is C:H/I:H/A:H, but the vulnerability itself is a SmartScreen security-feature bypass (CWE-41 path-equivalence), which does not directly grant code execution - the high impact reflects the downstream malware execution enabled once the Mark-of-the-Web / reputation warning is evaded, not a direct compromise. This is a real but conditional priority: it is a useful link in a social-engineering chain (it removes the user's last warning) rather than a wormable remote bug. SSVC 'Automatable: no' plus UI:R argues against mass automated exploitation; prioritize patching for endpoints exposed to untrusted file/web downloads, but it ranks below unauthenticated no-interaction RCEs. EPSS score was not provided in the input, so probabilistic exploitation likelihood cannot be factored in.

An attacker crafts a malicious file or installer using a path-equivalence manipulation and lures a Windows 11 user into downloading and opening it (phishing link or malicious download). Because SmartScreen fails to correctly resolve the path, its Mark-of-the-Web reputation/warning check is bypassed and the file runs without the usual security prompt, enabling the subsequent payload to compromise the host. No public exploit code is identified at time of analysis, and user interaction is required.