Windows MOTW EUVD-2026-35554

Exploitation requires a user to interact with a network-delivered file - specifically, the user must open or execute a file retrieved via a network path (such as a UNC share or WebDAV location) where the MOTW tagging logic fails; this is confirmed by UI:R in the CVSS vector. The attacker requires no authentication and no elevated privileges (PR:N), but cannot exploit this without the user taking an active action on the delivered file. Exploitation is limited by the requirement for user interaction, meaning fully automated, wormable propagation is not possible (aligned with SSVC Automatable: no). The bypass is constrained to the MOTW protection mechanism itself - it does not grant direct code execution; a secondary payload or social-engineering step is required to convert the bypass into meaningful attacker impact. Systems not using NTFS-formatted volumes or air-gapped from untrusted network sources have reduced exposure.

The CVSS base score of 5.4 (Medium) reflects a network-accessible, low-complexity, unauthenticated attack requiring user interaction with unchanged scope, delivering only Low integrity and Low availability impact - no confidentiality loss is scored. In isolation, this moderate score is accurate: the vulnerability does not directly execute code or exfiltrate data. Its real-world risk is elevated when considered as a prerequisite bypass in a multi-stage attack chain, where stripping MOTW silences SmartScreen warnings and disables Office macro safeguards, enabling a secondary payload to execute with reduced friction. SSVC signals reinforce the current moderate posture: Exploitation is listed as 'none', the attack is classified as non-automatable (aligning with UI:R in the CVSS vector), and Technical Impact is only partial. No EPSS score was provided in the supplied data. The combination of no KEV listing, no public POC, and a non-automatable SSVC classification suggests this is not under active widespread exploitation; however, the exceptionally wide scope of affected Windows versions makes patching a genuine priority before this appears in commodity phishing or malware delivery toolkits.

An attacker hosts a malicious Office document or executable on a network share or WebDAV endpoint and lures a target user into opening it via a phishing email or crafted link; because the MOTW Zone.Identifier tag is not correctly applied during retrieval, the file opens without a SmartScreen warning or Office Protected View prompt, allowing embedded macros or shellcode to execute without triggering standard user-facing security gates. No public proof-of-concept code exists at time of analysis, but the technique is consistent with established commodity malware delivery tradecraft where MOTW bypasses are routinely chained with macro-enabled documents.