CVE-2025-49740
Published: 08 July 2025
Summary
CVE-2025-49740 is a high-severity Protection Mechanism Failure (CWE-693) vulnerability in Microsoft Windows 10 1507. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Mark-of-the-Web Bypass (T1553.005); ranked in the top 22.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the protection mechanism failure in Windows SmartScreen by requiring timely application of vendor patches for this specific CVE.
Enables proactive identification of the Windows SmartScreen vulnerability through regular vulnerability scanning, facilitating patch deployment before exploitation.
Provides layered malicious code protection mechanisms that detect and block exploits even if SmartScreen is bypassed, reducing impact on confidentiality, integrity, and availability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct SmartScreen/MOTW bypass via protection mechanism failure enables T1553.005.
NVD Description
Protection mechanism failure in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network.
Deeper analysisAI
CVE-2025-49740 is a protection mechanism failure in Windows SmartScreen that allows an unauthorized attacker to bypass a security feature over a network. This vulnerability affects the Windows SmartScreen component and was published on 2025-07-08 with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). It is associated with CWE-693 (Protection Mechanism Failure).
The vulnerability can be exploited by an unauthorized attacker with network access, requiring low attack complexity and no privileges, though user interaction is necessary. Successful exploitation enables the attacker to bypass Windows SmartScreen protections, potentially leading to high impacts on confidentiality, integrity, and availability.
The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49740 provides guidance on patches and mitigation steps.
Details
- CWE(s)