Windows Shell Flaw (CVE-2026-32202) Actively Exploited – Microsoft

Summary

Microsoft confirmed that CVE-2026-32202, a Windows Shell vulnerability, is being actively exploited in the wild.
Key points:
• Affects Windows Shell (spoofing vulnerability)
• Exploited via malicious files (LNK)
• Can lead to sensitive information disclosure
• Part of a broader exploit chain tied to advanced threat actors
Despite a relatively low CVSS score (4.3), the flaw is high-risk in real-world scenarios due to active exploitation and chaining with other vulnerabilities.

Research Source
According to The Hacker News:
• Microsoft updated its advisory to confirm exploitation
• The vulnerability is linked to incomplete patching of a previous flaw
• Security researcher Maor Dahan identified the issue
Associated threat actor:
• APT28 (aka Fancy Bear)

Technical Details
Vulnerability Information
• CVE-2026-32202
• Type: Spoofing / Protection mechanism failure
• Impact: Confidentiality (information disclosure)
• Requires victim interaction (opening malicious file)
Root Cause
• Incomplete patch for:
• CVE-2026-21510 (Windows Shell)
• Leaves gap in:
• Path validation
• Trust verification

Exploit Chain
Attackers combine multiple vulnerabilities:
• CVE-2026-21510 – Security feature bypass (Windows Shell)
• CVE-2026-21513 – MSHTML bypass
• CVE-2026-32202 – Credential leakage via authentication coercion
Together, these enable:
• Code execution
• Credential theft
• Security bypass

Attack Mechanism
Initial Access
• Delivery via malicious .LNK (shortcut) file
Execution
• File triggers Windows Shell parsing
• Loads malicious payload from remote server
Key Technique
• Uses UNC path (e.g., \\attacker\share\payload.cpl)
Zero-Click Behavior
• System automatically:
• Resolves remote path
• Initiates SMB connection

Credential Theft (Critical Detail)
• SMB connection triggers automatic NTLM authentication
• Sends victim’s Net-NTLMv2 hash to attacker
This enables:
• NTLM relay attacks
• Offline password cracking
No user interaction required after file parsing (near zero-click)

Threat Actor
Attribution
• Linked to APT28
Characteristics:
• Nation-state level capability
• Targets:
• Ukraine
• European entities
Objective:
• Espionage
• Credential harvesting
• Initial access for deeper compromise

Observed Attack Activity
Initial Access
• Malicious LNK files delivered to targets
Execution
• Exploits Windows Shell parsing mechanism
Persistence
• Not directly stated, but enables follow-on attacks
Command & Control
• Remote payload hosted on attacker-controlled server
Credential Access
• NTLM hash leakage via SMB authentication

Impact
Technical Impact
• Exposure of sensitive system information
• Credential compromise (NTLM hashes)
• Potential lateral movement
Organizational Impact
• Domain credential theft
• Increased risk of internal compromise
• Bypass of security protections (SmartScreen)

Mitigation
Recommended actions:
• Apply latest Windows security updates immediately
• Block outbound SMB traffic where possible
• Disable NTLM where feasible
• Enforce SMB signing
• Use EDR to detect abnormal SMB connections
• Monitor for:
• Suspicious LNK execution
• UNC path access
• Enable MFA to reduce credential abuse

Key Takeaway
Even “low severity” vulnerabilities can be dangerous when exploited in chains.
This case highlights:
• The risk of incomplete patching
• The power of NTLM-based attacks
• The continued use of LNK + SMB techniques by APT groups

References
• https://thehackernews.com/2026/04/microsoft-confirms-active-exploitation.html