Unpatched Windows Search URI Vulnerability Lets Attackers Steal NTLMv2 Hashes

Summary: Huntress disclosed an unpatched flaw in the Windows "search:" URI handler that leaks a user's NTLMv2 hash, using "search:" and "crumb=location:" parameters in place of the "filePath" parameter that drove CVE-2026-33829 in the Snipping Tool, which Microsoft patched in April 2026. After responsible disclosure on April 15, 2026, Microsoft declined to address the issue, stating that only Important and Critical severity cases meet its bar for servicing, and the new issue carries the same Moderate rating as the earlier one.
What's compelling: A captured Net-NTLMv2 hash can be used in relay attacks to gain deeper access into a network, and Microsoft has said it will not fix this one - leaving blocking outbound SMB on TCP/445 and TCP/139, enforcing SMB signing, and disabling NTLM as the controls standing between the hash and your internal services.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2023-35636 CVE-2026-33829
Related: Microsoft releases lightest Patch Tuesday in three years, no zero-days disclosed Cyber Risks ·
Microsoft Patch Tuesday, December 2023 Edition Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026