CVE-2026-32202

CVE Enrichment

CVSS: 4.3 MEDIUM
EPSS: 70.90%
EPSS Percentile: 99.40%
CISA KEV: YES — Known Exploited Vulnerability

Description

Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 15-Apr-2026 01:17
Last Modified: 27-Oct-2026 04:10
EPSS Date: 2026-11-01
CWE: CWE-693

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:R /
                            S:U /
                            C:L /
                            I:N /
                            A:N

CISA KEV Details

Date Added: 2026-04-28
Remediation Due: 2026-05-12
Known Ransomware Campaign Use: Unknown
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-32202 ; https://nvd.nist.gov/vuln/detail/CVE-2026-32202

Affected Products / Versions

microsoft / windows_10_1607 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.14393.9060
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*
microsoft / windows_10_1607 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.14393.9060
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*
microsoft / windows_10_1809 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.17763.8644
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
microsoft / windows_10_1809 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.17763.8644
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*
microsoft / windows_10_21h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.19044.7184
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*
microsoft / windows_10_21h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.19044.7184
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*
microsoft / windows_10_21h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.19044.7184
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:*
microsoft / windows_10_22h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.19045.7184
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*
microsoft / windows_10_22h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.19045.7184
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*
microsoft / windows_10_22h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.19045.7184
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:*
microsoft / windows_11_23h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.22631.6936
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*
microsoft / windows_11_23h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.22631.6936
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*
microsoft / windows_11_24h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.26100.8246
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*
microsoft / windows_11_24h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.26100.8246
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*
microsoft / windows_11_25h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.26200.8246
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:*
microsoft / windows_11_25h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.26200.8246
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:*
microsoft / windows_11_26h1 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.28000.1836
cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:arm64:*
microsoft / windows_11_26h1 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.28000.1836
cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:x64:*
microsoft / windows_server_2012 Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
microsoft / windows_server_2012 Source: NVD CPE · affected
Version / affected range: r2
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
microsoft / windows_server_2016 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.14393.9060
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
microsoft / windows_server_2019 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.17763.8644
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
microsoft / windows_server_2022 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.20348.5020
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
microsoft / windows_server_2022_23h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.25398.2274
cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*
microsoft / windows_server_2025 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.26100.32690
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*

References

Last enrichment sync: 02-Nov-2026 20:04
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (4)

The report highlights active abuse of CVE-2026-21509, CVE-2026-21510, CVE-2026-32202, and several perimeter CVEs by actors including TA422 (APT28), TA406 (Opal Sleet), and TA569 (SocGholish). Proofpoint Observes 12 2026 CVEs in Exploitation, Four Not on CISA KEV
CISA has ordered federal agencies to patch Windows endpoints and servers for a zero-click vulnerability tracked as CVE-2026-32202 that Akamai said remained after an incomplete Microsoft fix for CVE-2026-21510. CISA Orders Federal Agencies to Patch Exploited Windows Flaw CVE-2026-32202
Attackers are exploiting CVE-2026-32202, a zero-click Windows Shell spoofing vulnerability that causes victims’ systems to authenticate with the attacker’s server and expose Net-NTLMv2 hashes. CISA and Microsoft Confirm Active Exploitation of Windows Shell Flaw CVE-2026-32202
The lack of proper patching, it says, resulted in a new vulnerability, tracked as CVE-2026-32202, an authentication coercion vulnerability that can be exploited without user interaction to steal credentials via Akamai Finds Windows Patch Flaw Enabling Zero-Click NTLM Credential Theft

CVE (8)

Malware (2)

People (1)

Threat Actors (8)

MITRE ATT&CK (10)

Vendors (6)

Products (14)

Industries (4)

Countries (3)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.