CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Windows Shell protection mechanism failure → NTLM coercion / spoofing (CVSS 4.3, APT28 ITW, KEV deadline 2026-05-12)

cve · CVE-2026-32202

Coverage
1
first 2026-05-08 → last 2026-09-30
Latest activity
2026-05-08
Opening a folder with a crafted shortcut sends the user's NTLM hash to an attacker. Exploited, and re-fixed…
Peak priority
notable
1 notable
Targets
·
regions: europe
Sources cited
3
3 hosts

Defender insights

What each entry about CVE-2026-32202 tells a defender to do, newest first.

2026-05-08NOTABLEexploitedOpening a folder with a crafted shortcut sends the user's NTLM hash to an attacker. Exploited, and re-fixed in July 2026

Exposure · detection

Story timeline

  1. 2026-05-08CVE-2026-32202 in Windows Shell: an incomplete fix for an APT28-exploited LNK flaw leaks NTLM hashes when a folder is opened, exploited and re-released in July (CVSS 4.3)
    trending-vulnerabilitiesOpening a folder with a crafted shortcut sends the user's NTLM hash to an attacker. Exploited, and re-fixed in July 2026

Hunting pivots

Affected products
Microsoft Windows
Tags
actively-exploitedcisa-kevpatch-availablevulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Credential AccessForced Authentication

Credential Access TA0006

T1187Forced Authentication×1

Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept.

Evidence: 2026-05-08/cve-2026-32202-windows-shell-ntlm-coercion-apt28-itw-cvss-4 · ATT&CK page ↗

Entries about Windows Shell protection mechanism failure → NTLM coercion / spoofing (CVSS 4.3, APT28 ITW, KEV deadline 2026-05-12) (1)

2026-05-08 · view entry permalink →

NOTABLECVE-2026-32202exploitedupdatedNATOA1

CVE-2026-32202 in Windows Shell: an incomplete fix for an APT28-exploited LNK flaw leaks NTLM hashes when a folder is opened, exploited and re-released in July (CVSS 4.3)

Microsoft describes CVE-2026-32202 as a "protection mechanism failure in Windows Shell" that "allows an unauthorized attacker to perform spoofing over a network", scored CVSS 4.3 and fixed on 2026-04-14; its record now shows exploitation detected (Microsoft Security Response Center, 2026-04-14). The flaw is what remained of Microsoft's February fix for CVE-2026-21510, which APT28 exploited together with CVE-2026-21513 through crafted LNK files: the February patch stopped code execution and the SmartScreen bypass, but Windows Explorer still opens an SMB connection to the attacker's server when it renders the folder that holds the shortcut, a connection "sending the victim's Net-NTLMv2 hash to the attacker, which can later be used for NTLM relay attacks and offline cracking" (Help Net Security, 2026-04-29). CISA added CVE-2026-32202 to its Known Exploited Vulnerabilities catalog on 2026-04-28 (CISA KEV catalog, 2026-04-28). No cited source says who exploits this CVE; the APT28 link belongs to its predecessors (Help Net Security, 2026-04-29).

Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.

Microsoft Security Response Center 2026-04-14
Correctionrun 2026-09-30T0639Z-audittitleheadlinesummaryevent_datetagstechniquesaffected_productssourcesevidenceverificationsourcing_noteclassificationbody

The earlier text said APT28 had weaponised CVE-2026-32202 against EU government ministries. APT28's exploitation concerns the predecessor flaws CVE-2026-21510 and CVE-2026-21513, and CVE-2026-32202 is what their February fix left open (Help Net Security, 2026-04-29). No source names who exploits this CVE, so the attribution is removed. The April 2026 update is also not the whole fix: Microsoft re-released the CVE on 2026-07-28 "to comprehensively address the vulnerability" and recommends the July 2026 updates (Microsoft Security Response Center, 2026-04-14).

vulnerability08 May 05:00Zmulti-sourceOpen finding →
Sources: Microsoft Security Response Center · Help Net Security · CISA KEV catalog

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • cisa.gov1 (33%)
  • helpnetsecurity.com1 (33%)
  • msrc.microsoft.com1 (33%)

External references

NVD · cve.org · CISA KEV

All cited sources (3)