Microsoft Confirms Active Exploitation of Windows Shell CVE-2026-32202

Summary: Microsoft revised its advisory for CVE-2026-32202, a high-severity Windows Shell spoofing vulnerability with a CVSS score of 4.3, to confirm it has been actively exploited in the wild after patching it in this month's Patch Tuesday update. On April 27, 2026, Microsoft corrected the Exploitability Index, Exploited flag, and CVSS vector it had published on April 14, while Akamai researcher Maor Dahan attributed the zero-click flaw to an incomplete patch for CVE-2026-21510, which APT28 has weaponized alongside CVE-2026-21513 against Ukraine and E.U. nations since December 2025.
Bottom line: The residual flaw lets a malicious LNK file trigger an SMB connection that hands the victim's Net-NTLMv2 hash to an attacker with no user interaction, feeding NTLM relay and offline cracking - and Microsoft's own advisory carried an incorrect Exploited flag for 13 days before it was corrected.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-21510 CVE-2026-21513 CVE-2026-32202
Related: CISA Adds Actively Exploited Connect Wise and Windows Flaws to KEV Cyber Risks ·
Microsoft Patches 59 Vulnerabilities Including Six Actively Exploited Zero-Days Cyber Risks ·
Microsoft Patch Tuesday for February 2026 — Snort rules and prominent vulnerabilities Cyber Risks ·