Loading story…
Researchers reported an unpatched NTLM credential coercion flaw in the Windows Explorer search: URI handler that can force a victim system to authenticate to an attacker-controlled SMB server and expose a Net-NTLMv2 hash after a single click on a crafted link. Testing showed the behavior worked on Windows 11 25H2 Pro with default Microsoft Defender settings, required no malware or elevated privileges, and could be triggered from both a command line and an Edge hyperlink that invoked the handler.
The issue was described as materially equivalent to Microsoft-patched CVE-2026-33829 in the Windows Snipping Tool because both involve unsafe URI parameter handling that leads to outbound UNC access and NTLM authentication. Huntress said Microsoft rated the search: issue as Moderate and declined to issue a fix, while analysis indicated search: and search-ms: share the same DelegateExecute CLSID and COM activation path in ExplorerFrame.dll, suggesting any durable remediation would need to occur in SearchExecute or related Explorer code rather than only at the URI-scheme layer. Recommended mitigations include blocking outbound SMB, enforcing SMB signing, restricting or disabling NTLM, and monitoring for search: and search-ms: URIs in email and proxy logs.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Huntress reported notifying Microsoft about the Windows search: URI NTLM hash leakage issue on 2026-04-15. Microsoft declined to service the vulnerability because it did not meet the threshold for Important or Critical severity.
Huntress published details of an NTLM credential coercion issue in Windows Explorer's search: URI handler that can leak a victim's Net-NTLMv2 hash to an attacker-controlled SMB server after a single click on a crafted link. The post says Microsoft Security Response Center rated the issue Moderate and declined to service it, while Huntress recommended mitigations such as blocking outbound SMB and restricting NTLM.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourcehuntress.com
Open sourcehuntress.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft confirmed that **CVE-2026-32202**, a patched Windows Shell spoofing flaw, has been actively exploited in the wild after initially publishing incorrect exploitability information. The vulnerability is a **zero-click authentication coercion issue** tied to an incomplete fix for **CVE-2026-21510** and can be triggered when Windows Explorer processes a malicious `.LNK` file. Researchers said the shortcut’s crafted `LinkTargetIDList` can force the system to resolve an attacker-controlled UNC path, causing an outbound SMB connection and NTLM authentication attempt before SmartScreen trust checks occur. Akamai and CERT-UA linked the activity to **APT28**, which used weaponized LNK files in campaigns against Ukraine and several EU countries beginning in December 2025, chaining **CVE-2026-21513** with **CVE-2026-21510** for code execution and then abusing the residual flaw to capture **Net-NTLMv2** hashes for relay attacks or offline cracking. Microsoft addressed **CVE-2026-32202** in its April 2026 Patch Tuesday release, and defenders were urged to patch quickly, monitor outbound SMB traffic, and reduce or harden NTLM usage to limit follow-on credential abuse.
Jun 29, 2026
Microsoft has patched **CVE-2026-33829**, a spoofing vulnerability in the Windows Snipping Tool that can trigger an authenticated SMB connection to an attacker-controlled server and expose a victim’s **NTLMv2 password hash**. The flaw stems from improper validation of deep links using the `ms-screensketch` URI scheme, allowing attackers to coerce the application into initiating network authentication and leaking credentials over the network. Researchers at **Blackarrow (Tarlogic)** reported the issue, which Microsoft rated **moderate severity** with a **CVSS 3.1 score of 4.3** and said was **not known to be exploited in the wild**. Exploitation requires user interaction, such as clicking a malicious link in a phishing email or on a compromised website, but the attack complexity is considered low. Affected systems include multiple **Windows 10, Windows 11, and Windows Server** releases, and recommended defenses include applying Microsoft’s update, blocking outbound SMB traffic on port `445`, and warning users against suspicious links and application launch prompts.
Jun 29, 2026
Microsoft disclosed and patched several spoofing vulnerabilities across Windows and Exchange Server, including **NTLM hash disclosure** issues tracked as `CVE-2025-24996`, `CVE-2025-59185`, and `CVE-2025-59244`, a **Windows NTLM spoofing** flaw `CVE-2025-21217`, a **Windows Themes spoofing** bug `CVE-2025-21308`, a **Windows Shell Link Processing spoofing** issue `CVE-2026-25185`, and an older **Microsoft Exchange Server spoofing** vulnerability `CVE-2021-24085`. The advisories indicate a broad set of weaknesses that could let attackers disguise content or trigger credential exposure through trusted Windows components and enterprise messaging infrastructure. The concentration of flaws around NTLM and user-facing file handling highlights continued risk from spoofing paths that can mislead users or disclose authentication material. For defenders, the updates underscore the need to prioritize Microsoft security patches for systems handling Windows authentication, shell link processing, themes, and Exchange workloads, especially where NTLM remains enabled and could be leveraged for credential theft or follow-on intrusion.
Jul 12, 2026