PT-2026-32854 · Microsoft · Windows Shell+1

Maor Dahan · Published 2026-04-14 · Updated 2026-06-05 · CVE-2026-32202

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to April 2026

Description A protection mechanism failure in the Windows Shell allows an unauthorized remote attacker to perform spoofing. The issue occurs because Windows Explorer automatically attempts to fetch icons via UNC paths, triggering an NTLM handshake. This allows a malicious Windows shortcut or LNK path to initiate an automatic SMB authentication attempt, exposing the victim's Net-NTLMv2 hash for potential relay or offline cracking without any user interaction. This flaw has been actively exploited by APT28 (also known as Fancy Bear) in attacks targeting Ukraine and European nations.

Recommendations Update Microsoft Windows to the version released in April 2026.

Exploit

Fix

RCE

DoS

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

BDU:2026-05493

CVE-2026-32202

Affected Products

Windows

Windows Shell

References · 175

• 🔥 https://exploit-db.com/exploits/52601 · Exploit
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32202 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-32202 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05493 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-32202 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-32202 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32202 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32202 · Security Note
• https://twitter.com/UndercodeUpdate/status/2049014644228948222 · Twitter Post
• https://twitter.com/lyrie_ai/status/2059171739481886952 · Twitter Post
• https://twitter.com/VulnPath/status/2049191311488716814 · Twitter Post
• https://twitter.com/lordman1982/status/2049564619153252606 · Twitter Post
• https://twitter.com/TheCyberSecHub/status/2049165842689016133 · Twitter Post
• https://t.me/secharvester/22284 · Telegram Post
• https://twitter.com/Visuality_NQ/status/2051628264305651714 · Twitter Post