Loading story…
Microsoft confirmed that CVE-2026-32202, a patched Windows Shell spoofing flaw, has been actively exploited in the wild after initially publishing incorrect exploitability information. The vulnerability is a zero-click authentication coercion issue tied to an incomplete fix for CVE-2026-21510 and can be triggered when Windows Explorer processes a malicious .LNK file. Researchers said the shortcut’s crafted LinkTargetIDList can force the system to resolve an attacker-controlled UNC path, causing an outbound SMB connection and NTLM authentication attempt before SmartScreen trust checks occur.
Akamai and CERT-UA linked the activity to APT28, which used weaponized LNK files in campaigns against Ukraine and several EU countries beginning in December 2025, chaining CVE-2026-21513 with CVE-2026-21510 for code execution and then abusing the residual flaw to capture Net-NTLMv2 hashes for relay attacks or offline cracking. Microsoft addressed CVE-2026-32202 in its April 2026 Patch Tuesday release, and defenders were urged to patch quickly, monitor outbound SMB traffic, and reduce or harden NTLM usage to limit follow-on credential abuse.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
On 2026-04-29, CISA added Microsoft Windows Shell flaw CVE-2026-32202 to its Known Exploited Vulnerabilities catalog. The agency directed U.S. federal civilian agencies to remediate the issue under Binding Operational Directive 22-01 by 2026-05-12.
Notepad++ addressed CVE-2026-3008 in version 8.9.4. The update remediated the string-injection issue in the localization parser and also included additional bug fixes and stability improvements.
By April 28, 2026, Microsoft revised its advisory to state that CVE-2026-32202 had been actively exploited in the wild. Reporting tied the flaw to prior APT28 tradecraft and highlighted the risk of zero-click NTLM hash leakage when victims merely browse to a folder containing a malicious LNK file.
A format string injection flaw affecting Notepad++ 8.9.3, tracked as CVE-2026-3008, was reported through CSA's Responsible Vulnerability Disclosure Policy, with Hazley Samsudin credited for identifying it. The bug could leak memory contents or crash the application via crafted localization data.
On 2026-04-23, Akamai published technical analysis showing that attackers could craft Windows LNK files using the LinkTargetIDList structure to mimic Control Panel objects and embed a UNC path to an attacker-controlled CPL module. The write-up explained how shell32.dll and Windows Explorer process the shortcut in a way that can trigger outbound SMB authentication and support the CVE-2026-32202 exploitation chain.
In April 2026 Patch Tuesday, Microsoft released a patch for CVE-2026-32202, a zero-click Windows Shell vulnerability that can coerce a victim system into authenticating to an attacker-controlled SMB server when a malicious file is processed. The issue can expose Net-NTLMv2 hashes for relay attacks or offline cracking.
On April 14, 2026, Microsoft initially published advisory information for CVE-2026-32202 with incorrect exploitability details. The flaw is a Windows Shell spoofing and authentication coercion issue stemming from the incomplete fix for CVE-2026-21510.
In February 2026, Microsoft fixed the original remote code execution path for CVE-2026-21510 by adding SmartScreen trust verification. Researchers later found the fix was incomplete because Windows icon extraction still triggered outbound SMB connections and NTLM authentication before trust checks.
Beginning in December 2025, the Russian state-linked group APT28 used weaponized LNK files to target Ukraine and several EU countries. The campaign chained CVE-2026-21513 with CVE-2026-21510 to bypass SmartScreen, load remote content over UNC paths, and achieve code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
13 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcesecurityaffairs.com
Open sourcethecyberexpress.com
Open sourcethehackernews.com
Open sourcecvereports.com
Open sourceakamai.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has patched **CVE-2026-33829**, a spoofing vulnerability in the Windows Snipping Tool that can trigger an authenticated SMB connection to an attacker-controlled server and expose a victim’s **NTLMv2 password hash**. The flaw stems from improper validation of deep links using the `ms-screensketch` URI scheme, allowing attackers to coerce the application into initiating network authentication and leaking credentials over the network. Researchers at **Blackarrow (Tarlogic)** reported the issue, which Microsoft rated **moderate severity** with a **CVSS 3.1 score of 4.3** and said was **not known to be exploited in the wild**. Exploitation requires user interaction, such as clicking a malicious link in a phishing email or on a compromised website, but the attack complexity is considered low. Affected systems include multiple **Windows 10, Windows 11, and Windows Server** releases, and recommended defenses include applying Microsoft’s update, blocking outbound SMB traffic on port `445`, and warning users against suspicious links and application launch prompts.
Jun 29, 2026
Researchers reported an unpatched NTLM credential coercion flaw in the Windows Explorer `search:` URI handler that can force a victim system to authenticate to an attacker-controlled SMB server and expose a Net-NTLMv2 hash after a single click on a crafted link. Testing showed the behavior worked on Windows 11 25H2 Pro with default Microsoft Defender settings, required no malware or elevated privileges, and could be triggered from both a command line and an Edge hyperlink that invoked the handler. The issue was described as materially equivalent to Microsoft-patched `CVE-2026-33829` in the Windows Snipping Tool because both involve unsafe URI parameter handling that leads to outbound UNC access and NTLM authentication. Huntress said Microsoft rated the `search:` issue as **Moderate** and declined to issue a fix, while analysis indicated `search:` and `search-ms:` share the same `DelegateExecute` CLSID and COM activation path in `ExplorerFrame.dll`, suggesting any durable remediation would need to occur in `SearchExecute` or related Explorer code rather than only at the URI-scheme layer. Recommended mitigations include blocking outbound SMB, enforcing SMB signing, restricting or disabling NTLM, and monitoring for `search:` and `search-ms:` URIs in email and proxy logs.
Jun 29, 2026
Microsoft disclosed and patched several spoofing vulnerabilities across Windows and Exchange Server, including **NTLM hash disclosure** issues tracked as `CVE-2025-24996`, `CVE-2025-59185`, and `CVE-2025-59244`, a **Windows NTLM spoofing** flaw `CVE-2025-21217`, a **Windows Themes spoofing** bug `CVE-2025-21308`, a **Windows Shell Link Processing spoofing** issue `CVE-2026-25185`, and an older **Microsoft Exchange Server spoofing** vulnerability `CVE-2021-24085`. The advisories indicate a broad set of weaknesses that could let attackers disguise content or trigger credential exposure through trusted Windows components and enterprise messaging infrastructure. The concentration of flaws around NTLM and user-facing file handling highlights continued risk from spoofing paths that can mislead users or disclose authentication material. For defenders, the updates underscore the need to prioritize Microsoft security patches for systems handling Windows authentication, shell link processing, themes, and Exchange workloads, especially where NTLM remains enabled and could be leveraged for credential theft or follow-on intrusion.
Jul 12, 2026