CVE-2026-32202: The Trust Check Runs at the Click. The Coercion Runs at the Icon

CVE-2026-32202: The Trust Check Runs at the Click. The Coercion Runs at the Icon

Akamai researchers analyzed the Windows Shell vulnerability CVE-2026-32202, which resulted from an incomplete fix for the previously exploited CVE-2026-21510.

In February 2026, Microsoft patched the remote code execution vector by enforcing SmartScreen trust verification before executing Control Panel applets, but one issue went unnoticed: Explorer still automatically connects to an attacker's SMB server when displaying a folder's contents.

The Microsoft patch moved the trust verification (ControlPanelLinkSite, IVerifyingTrust::OnVerifyingTrust) only to the execution stage via ShellExecuteExW, but didn't fix the execution path during enumeration, tooltip display, or preview. Because of a bug in shell32.dll, the _IDCONTROLW structure for Control Panel items (Control Panel applet) can trigger a call to PathFileExistsW by viewing a folder containing a .lnk file. This causes Explorer to initiate an SMB connection and leak the NTLMv2 hash before any user interaction and regardless of SmartScreen.

Article: https://nefariousplan.com/posts/cve-2026-32202-trust-check-at-the-click

PoC: https://github.com/virus-or-not/CVE-2026-32202