Microsoft Confirms Active Exploitation of Windows Shell CVE-2026-32202

Microsoft confirmed active exploitation of CVE-2026-32202, a high-severity Windows Shell spoofing vulnerability (CVSS 4.3) that allows unauthorized access to sensitive information.

• •The vulnerability stems from an incomplete patch for CVE-2026-21510 and is weaponized by Russian APT28 in exploit chains with CVE-2026-21513
• •Attackers use malicious Windows Shortcut (LNK) files to bypass Microsoft Defender SmartScreen without user interaction
• •The attack triggers automatic NTLM authentication, sending the victim's Net-NTLMv2 hash to attacker servers for credential theft and relay attacks
• •While the February 2026 patch mitigated remote code execution, CVE-2026-32202 remains as a zero-click credential theft vector through auto-parsed LNK files

This summary was automatically generated by AI based on the original article and may not be fully accurate.