Windows Shell Zero‑Click Vulnerability CVE‑2026‑32202
In April 2026, Microsoft confirmed active exploitation of a zero‑click Windows Shell vulnerability tracked as CVE‑2026‑32202. The flaw allows attackers to silently steal NTLM credentials when a user merely views a folder containing a malicious shortcut—no opening, clicking, or execution required. The issue stems from an incomplete February patch and has been abused in the wild, prompting CISA to add it to the Known Exploited Vulnerabilities (KEV) catalog with a federal patch deadline of May 12, 2026.
What makes this “zero‑click”?
Unlike typical phishing or malware attacks that require user interaction, this flaw triggers when Windows Explorer renders a directory. Explorer automatically parses shortcut metadata (e.g., to fetch icons). A crafted
.lnk file can embed a UNC path (e.g., \\attacker\share\file) that causes Windows to auto‑initiate an SMB connection to an attacker‑controlled server—without any user action—leaking the victim’s Net‑NTLMv2 hash.Root cause and patch lineage
- February 2026: Microsoft patches CVE‑2026‑21510 (Windows Shell namespace parsing; used with CVE‑2026‑21513 in attacks by Russia‑linked APT28). The fix blocks a remote code execution path but does not fully close an authentication‑coercion path.
- Discovery: Akamai researchers find the incomplete fix leaves a zero‑click credential‑theft vector.
- April 14, 2026: Microsoft ships a patch for CVE‑2026‑32202 (initially assessed as moderate severity).
- April 27–29, 2026: Microsoft and CISA update advisories to confirm active exploitation; CVE added to KEV.
Impact
- Credential theft: Steals NTLMv2 hashes, enabling NTLM relay, lateral movement, and potential domain compromise.
- Stealth: No prompts or warnings; browsing a folder is enough.
- Attribution: Observed in campaigns attributed to APT28 (Fancy Bear) targeting Ukraine and EU organizations.
- Severity caveat: Although CVSS is 4.3 (Medium), real‑world risk is high due to zero‑click exploitation and credential exposure.
Affected systems
- Windows clients/servers that have not applied the April 2026 update addressing CVE‑2026‑32202.
Detection clues
- Unexpected outbound SMB (TCP 445/139) connections from Explorer activity
- NTLM authentication attempts to unknown external hosts
- Presence of unusual
.lnkfiles in shared folders or email‑delivered archives
Mitigation and remediation (do this now)
- Apply Microsoft’s April 2026 patches that fix CVE‑2026‑32202.
- Block outbound SMB (TCP 445/139) at the network edge where feasible to prevent credential leakage.
- Restrict NTLM (prefer Kerberos; enforce NTLM blocking/logging per best practice).
- Harden Explorer behaviors and monitor for LNK abuse in shared paths and inboxes.
- Prioritize patching for internet‑exposed endpoints, admins’ workstations, and systems handling sensitive data—per CISA KEV guidance.
Bottom line
CVE‑2026‑32202 is a rare, real‑world zero‑click Windows credential‑theft bug. Even though it carries a modest CVSS score, its silent exploitation and lateral‑movement potential make it urgent. Patch immediately and reduce NTLM/SMB exposure.
If you want, I can:
- Check which Windows builds are patched in your environment
- Provide Group Policy hardening steps for NTLM/SMB
- Map detections to Microsoft Defender / SIEM queries
.png)
.png)