CISA and Microsoft Confirm Active Exploitation of Windows Shell Flaw CVE-2026-32202
Summary
CISA and Microsoft confirmed active exploitation of CVE-2026-32202, which can make Windows Explorer trigger SMB-based NTLM authentication while rendering a malicious LNK icon. Microsoft issued a patch on April 14, 2026.
Key points
- Opening a folder containing a malicious LNK can prompt Windows Explorer to initiate an SMB connection while rendering the shortcut's icon.
- The connection can send a victim's Net-NTLMv2 hash to an attacker, who may use it for NTLM relay attacks or offline cracking.
- The flaw is described as an incomplete fix related to CVE-2026-21510 and CVE-2026-21513, previously exploited by APT28.
- CVE-2026-32202 affects supported Windows 10, Windows 11, and Windows Server versions.
- Microsoft released a patch on April 14, 2026; CISA and Microsoft confirmed active exploitation more than two weeks later.
- The article recommends applying the patch and, where feasible, blocking outbound SMB traffic at the network perimeter.
Article Details
- Vulnerability Types
- Windows Shell spoofing
- SMB-triggered automatic NTLM authentication
- Affected Versions
- Windows 10
- Windows 11
- Windows Server
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Apply Microsoft's April 14, 2026 patch.
- Where feasible, block outbound SMB traffic at the network perimeter.
MITRE ATT&CK
CVE
CVE-2026-21510Microsoft · Windows 10 1607; Microsoft · Windows 10 1809; +11 moreThe vulnerability resulted from an incomplete fix for CVE-2026-21510 and is related to CVE-2026-21513 exploited by APT28.CVE-2026-21513Microsoft · Windows 10 Version 1607; Microsoft · Windows 10 Version 1809; +19 moreThe vulnerability resulted from an incomplete fix for CVE-2026-21510 and is related to CVE-2026-21513 exploited by APT28.CVE-2026-32202Microsoft · Windows 10 1607; Microsoft · Windows 10 1809; +12 moreAttackers are exploiting CVE-2026-32202, a zero-click Windows Shell spoofing vulnerability that causes victims’ systems to authenticate with the attacker’s server and expose Net-NTLMv2 hashes.
People
Threat Actors
APT28The article says APT28 exploited CVE-2026-21510 in conjunction with CVE-2026-21513 using weaponized LNK files; it does not attribute exploitation of CVE-2026-32202 to the group.Fancy BearThe article identifies Fancy Bear as an alias for APT28, which it says exploited CVE-2026-21510 in conjunction with CVE-2026-21513 using weaponized LNK files; it does not attribute exploitation of CVE-2026-32202 to the group.