CVE-2025-27472: Windows 10 1507 MOTW Auth Bypass Flaw

CVE-2025-27472 Overview

CVE-2025-27472 is a protection mechanism failure [CWE-693] in the Windows Mark of the Web (MOTW) security feature. An unauthorized attacker can bypass MOTW enforcement over a network, causing files downloaded from untrusted sources to lose their zone identifier. This allows malicious content to execute without triggering SmartScreen warnings, Protected View in Office, or other zone-based defenses. Microsoft assigned this vulnerability a CVSS 3.1 score of 5.4 with medium severity. Exploitation requires user interaction, such as opening a crafted file delivered through email, a web download, or a network share. The vulnerability affects legacy Windows platforms, including Windows 10 version 1507 and Windows Server 2012.

Critical Impact
Attackers can strip the Mark of the Web from downloaded files, bypassing SmartScreen and Office Protected View to deliver malware that runs with normal file trust on the target host.

Affected Products

Microsoft Windows 10 version 1507 (x86 and x64)
Microsoft Windows Server 2012
Microsoft Windows Server 2012 R2

Discovery Timeline

2025-04-08 - CVE-2025-27472 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27472

Vulnerability Analysis

Mark of the Web is a Windows security feature that tags files originating from untrusted zones with a Zone.Identifier alternate data stream (ADS). Applications such as Microsoft Office, Windows SmartScreen, and Windows Defender use this tag to apply stricter execution controls. CVE-2025-27472 breaks this protection chain by allowing files delivered over a network to arrive without the expected zone marker.

The vulnerability is classified as CWE-693: Protection Mechanism Failure. It does not grant code execution on its own. Instead, it removes a defensive layer, enabling downstream exploitation techniques such as macro-based attacks, ISO or VHD container smuggling, and LNK-based payload delivery. Threat actors have historically abused MOTW bypasses to distribute Emotet, Qakbot, and various ransomware families.

Root Cause

The root cause lies in how affected Windows components handle zone attribution when files are received through specific network transport paths. The propagation logic fails to persist the Zone.Identifier ADS on the resulting file. Without this marker, SmartScreen and Office Protected View treat the content as locally trusted, skipping reputation checks and sandboxing.

Attack Vector

Exploitation requires user interaction. An attacker hosts a crafted file on an attacker-controlled server or share and lures a user into retrieving and opening it. Because MOTW is not applied, the file executes without the standard warning prompts. The attack vector is network-based with low complexity and no privileges required, consistent with the CVSS vector components for this issue. Refer to the Microsoft Security Update CVE-2025-27472 advisory for detailed component information.

Detection Methods for CVE-2025-27472

Indicators of Compromise

Files executed from user download or temp directories that lack a Zone.Identifier alternate data stream despite originating from remote sources.
Office documents opening without Protected View when sourced from email attachments or internet downloads.
Unexpected child processes such as powershell.exe, wscript.exe, or mshta.exe spawned by winword.exe, excel.exe, or archive utilities.
Container files such as .iso, .img, .vhd, or .lnk delivered from network locations followed by immediate script or binary execution.

Detection Strategies

Enumerate the Zone.Identifier ADS on files in user profile directories using Get-Item -Stream Zone.Identifier and flag missing markers on recently downloaded content.
Correlate browser and email client file writes with subsequent process launches to detect MOTW-less execution chains.
Deploy behavioral EDR rules that identify Office and archive utility child processes launching interpreters or LOLBins.

Monitoring Recommendations

Ingest Sysmon Event ID 15 (FileCreateStreamHash) to track Zone.Identifier creation and absence on downloaded files.
Monitor SMB and WebDAV file transfers from external ranges and alert when destination files execute within short time windows.
Baseline SmartScreen reputation events and investigate gaps where expected prompts do not appear for internet-sourced files.

How to Mitigate CVE-2025-27472

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2025-27472 to all affected Windows 10 1507 and Windows Server 2012/2012 R2 systems.
Restrict outbound access to untrusted WebDAV and SMB endpoints at the network perimeter.
Enforce Microsoft Office policies that block macros in files from the internet, independent of MOTW status.

Patch Information

Microsoft released a security update addressing CVE-2025-27472. Administrators should deploy the applicable cumulative update for Windows 10 version 1507 and the monthly rollup for Windows Server 2012 and 2012 R2. Confirm patch installation through Windows Update history or the Get-HotFix cmdlet and validate coverage across all endpoints using standard patch management reporting.

Workarounds

Block inbound delivery of high-risk container formats such as .iso, .img, .vhd, and .vhdx at email and web gateways.
Configure Attack Surface Reduction (ASR) rules to block executable content from email clients, webmail, and Office child process creation.
Deploy Windows Defender Application Control (WDAC) or AppLocker policies to restrict execution of unsigned binaries from user-writable locations.

bash

# Configuration example: enable ASR rules that reduce MOTW bypass impact
Set-MpPreference -AttackSurfaceReductionRules_Ids `
  BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550,`
  D4F940AB-401B-4EFC-AADC-AD5F3C50688A,`
  3B576869-A4EC-4529-8536-B80A7769E899 `
  -AttackSurfaceReductionRules_Actions Enabled,Enabled,Enabled