First day on Intigriti: our agent harness found and proved a remote code execution bug, paid €3,000.

CVE-2022-44698

MediumCVSS 5.4/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Windows SmartScreen Security Feature Bypass Vulnerability

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Affected software

Vendor	Product	Versions
Microsoft	Windows 10 Version 1809	>= 10.0.17763.0, < 10.0.17763.3770
Microsoft	Windows 10 Version 1809	>= 10.0.0, < 10.0.17763.3770
Microsoft	Windows Server 2019	>= 10.0.17763.0, < 10.0.17763.3770
Microsoft	Windows 10 Version 21H1	>= 10.0.0, < 10.0.19043.2364
Microsoft	Windows Server 2022	>= 10.0.20348.0, < 10.0.20348.1366
Microsoft	Windows 10 Version 20H2	>= 10.0.0, < 10.0.19042.2364
Microsoft	Windows 11 version 21H2	>= 10.0.22000.0, < 10.0.22000.1335
Microsoft	Windows 10 Version 21H2	>= 10.0.19044.0, < 10.0.19044.2364
Microsoft	Windows 10 Version 22H2	>= 10.0.19045.0, < 10.0.19045.2364
Microsoft	Windows 10 Version 1607	>= 10.0.14393.0, < 10.0.14393.5582
Microsoft	Windows Server 2016	>= 10.0.14393.0, < 10.0.14393.5582

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44698Patch, Vendor Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44698Patch, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-44698US Government Resource

Timeline

Published: Dec 13, 2022
Last modified: Jun 17, 2026
Added to CISA KEV: Dec 13, 2022
NVD status: Analyzed

Related CVEs from 2022

CVE-2022-446995.5Azure Network Watcher Agent Security Feature Bypass Vulnerability CVE-2022-44705.4The Widgets for Google Reviews WordPress plugin before 9.8 does not validate and escape some of its shortcode attributes before outputting t CVE-2022-447027.8Windows Terminal Remote Code Execution Vulnerability CVE-2022-447047.8Microsoft Windows System Monitor (Sysmon) Elevation of Privilege Vulnerability CVE-2022-447076.5Windows Kernel Denial of Service Vulnerability CVE-2022-447088.3Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability CVE-2022-44715.4The YARPP WordPress plugin before 5.30.3 does not validate and escape some of its shortcode attributes before outputting them back in a page CVE-2022-447107.8DirectX Graphics Kernel Elevation of Privilege Vulnerability CVE-2022-447137.5Microsoft Outlook for Mac Spoofing Vulnerability CVE-2022-447158.8Improper File Permissions in NetScout nGeniusONE 6.3.2 build 904 allows authenticated remote users to gain permissions via a crafted payload CVE-2022-447173.1An issue was discovered in NetScout nGeniusONE 6.3.2 build 904. Open Redirection can occur (issue 1 of 2). After successful login, an attack CVE-2022-447183.5An issue was discovered in NetScout nGeniusONE 6.3.2 build 904. Open Redirection can occur (issue 2 of 2). After successful login, an attack