Akamai Finds Windows Patch Flaw Enabling Zero-Click NTLM Credential Theft
Summary
Akamai says an incomplete February patch for CVE-2026-21510 left Windows vulnerable to zero-click credential theft via malicious LNK files. Microsoft fixed the new flaw, CVE-2026-32202, in April; APT28 likely exploited the chain in late 2025.
Key points
- CVE-2026-21510 was patched in February 2026; Microsoft said it had been exploited as a zero-day, and exploitation could enable remote code execution if a victim opened a malicious shortcut.
- Akamai found the February patch still allowed Windows Explorer to fetch an icon from an attacker-controlled UNC path, triggering an SMB connection without user interaction.
- The connection could trigger NTLM authentication and expose the victim's Net-NTLMv2 hash, which attackers could later use for NTLM relay attacks or offline cracking.
- Akamai tracked the incomplete-patch issue as CVE-2026-32202, an authentication-coercion vulnerability exploitable without user interaction. Microsoft released a fix in April 2026 and marked the flaw as exploited.
- Akamai says APT28 likely exploited CVE-2026-21510 and CVE-2026-21513 in December 2025 attacks targeting Ukraine and EU countries, using weaponized LNK files; Microsoft did not detail the observed attacks.
Article Details
- Vulnerability Types
- Remote code execution
- Security feature bypass
- Authentication coercion
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
CVE
CVE-2026-21510Microsoft · Windows 10 1607; Microsoft · Windows 10 1809; +11 moreThe initial vulnerability, tracked as CVE-2026-21510 and patched in February, could be exploited for remote code execution (RCE) if the attacker could convince the victim to open a malicious shortcut file.CVE-2026-21513Microsoft · Windows 10 Version 1607; Microsoft · Windows 10 Version 1809; +19 moreForest Blizzard, GruesomeLarch, and Sofacy, exploited CVE-2026-21510 in attacks that also targeted CVE-2026-21513, a security feature bypass in the MSHTML framework patched in February as well.CVE-2026-32202Microsoft · Windows 10 1607; Microsoft · Windows 10 1809; +12 moreThe lack of proper patching, it says, resulted in a new vulnerability, tracked as CVE-2026-32202, an authentication coercion vulnerability that can be exploited without user interaction to steal credentials via
Threat Actors
APT28Akamai says APT28 likely exploited the vulnerabilities in December 2025 attacks against Ukraine and European Union countries. The article identifies Fancy Bear, Forest Blizzard, GruesomeLarch, and Sofacy as aliases.Fancy BearThe article identifies Fancy Bear as an alias of APT28, which Akamai says likely exploited the vulnerabilities in December 2025.GruesomeLarchThe article identifies GruesomeLarch as an alias of APT28, which Akamai says likely exploited the vulnerabilities in December 2025.
Vendors
Products
Microsoft Defender SmartScreenIncomplete patch for a Windows SmartScreen and Windows Shell security prompts bypass created a new bug enabling zero-click attacks, Akamai reports.Microsoft WindowsIncomplete patch for a Windows SmartScreen and Windows Shell security prompts bypass created a new bug enabling zero-click attacks, Akamai reports.MSHTMLexploited CVE-2026-21510 in attacks that also targeted CVE-2026-21513, a security feature bypass in the MSHTML framework patched in February as well.Windows ShellIncomplete patch for a Windows SmartScreen and Windows Shell security prompts bypass created a new bug enabling zero-click attacks, Akamai reports.
Countries
RussiaNow, Akamai says Russia-linked APT28, also known as Fancy Bear, Forest Blizzard, GruesomeLarch, and Sofacy, exploited CVE-2026-21510 in attacks that also targeted CVE-2026-21513, a security feature bypass in the MSHTMLUkraineAccording to Akamai, these vulnerabilities were likely exploited by APT28 in December 2025, in attacks against Ukraine and European Union countries.