PT-2026-32854 · Microsoft · Windows Shell+1

Maor Dahan · CVE-2026-32202 · Published 2026-04-14 · Updated 2026-07-14

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Windows (affected versions not specified)

Description A protection mechanism failure in the Windows Shell allows a remote unauthorized attacker to perform spoofing. The issue occurs when a malicious Windows shortcut or LNK path triggers an automatic SMB authentication attempt, which exposes the victim's Net-NTLMv2 hash for potential offline cracking or relay attacks. This flaw can be triggered without user interaction, such as when a user simply opens a folder containing a malicious shortcut. This issue has been actively exploited in the wild by APT28 (Fancy Bear) targeting Ukraine and EU nations as part of a larger exploit chain to steal credentials and download malicious code from remote servers.

Recommendations Apply the security updates released in April 2026.

Exploit

Fix

DoS

RCE

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

BDU:2026-05493

CVE-2026-32202

Affected Products

Windows

Windows Shell

References · 185

• 🔥 https://exploit-db.com/exploits/52601 · Exploit
• https://osv.dev/vulnerability/BELL-CVE-2026-32202 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32202 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32202 · Security Note
• https://bdu.fstec.ru/vul/2026-05493 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-32202 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-32202 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32202 · Security Note
• https://twitter.com/seoscottsdale/status/2049500807553544662 · Twitter Post
• https://reddit.com/r/SecOpsDaily/comments/1sulo7d/a_shortcut_to_coercion_incomplete_patch_of_apt28s · Reddit Post
• https://twitter.com/mcnc/status/2049944748975132739 · Twitter Post
• https://twitter.com/ConanPayne60594/status/2049478921184330125 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1syymni/cisa_flags_connectwise_and_windows · Reddit Post
• https://twitter.com/shah_sheikh/status/2049435344328941959 · Twitter Post
• https://twitter.com/VulnPath/status/2049191311488716814 · Twitter Post