Key Takeaways
- Microsoft and CISA have warned that attackers are actively exploiting a newly disclosed zero‑click Windows flaw (CVE‑2026‑32202) that can leak sensitive authentication data.
- The vulnerability stems from an incomplete patch for an earlier flaw (CVE‑2026‑21510) that Russian APT28 (Fancy Bear) abused in January 2026 against Ukrainian and EU targets.
- CISA added CVE‑2026‑32202 to its Known Exploited Vulnerabilities catalog and set a May 12 deadline for federal agencies to apply the fix.
- Exploitation requires no user interaction; attackers can coerce a victim’s system to send Net‑NTLMv2 hashes via auto‑parsed LNK files, enabling credential theft and lateral movement.
- Akamai security researcher Maor Dahan discovered the bug while testing February’s patches and reported it to Microsoft; mitigation includes applying the latest Windows updates and restricting LNK file handling.
Overview of the Vulnerability
Microsoft disclosed CVE‑2026‑32202 on April 14, describing it as an authentication coercion flaw in the Windows Shell. Successful exploitation allows an attacker to view certain sensitive information on a vulnerable system without any user interaction. The flaw is classified as a zero‑click vulnerability because the malicious payload is triggered automatically when the system processes a specially crafted LNK (shortcut) file, even if the user never opens or clicks the file.
CISA Alert and Federal Deadline
On the day after Microsoft’s public disclosure, the Windows division marked the bug as “exploitation detected.” CISA responded by adding CVE‑2026‑32202 to its Known Exploited Vulnerabilities (KEV) catalog on April 15 and issued a binding directive requiring all federal agencies to remediate the flaw by May 12, 2026. The agency emphasized that timely patching is critical to prevent further credential‑theft campaigns targeting government networks.
Technical Details of the Zero‑Click Flaw
The core issue lies in how Windows Shell resolves paths and verifies trust when processing LNK files. An incomplete check leaves a window where the system will automatically authenticate to an attacker‑controlled server, transmitting the victim’s Net‑NTLMv2 hash. This hash can be cracked or used in relay attacks to impersonate the user, granting the intruder access to files, email, and other network resources without needing passwords or user consent.
Root Cause: Incomplete Patch of CVE‑2026‑21510
Researcher Maor Dahan of Akamai traced CVE‑2026‑32202 to a deficient fix for CVE‑2026‑21510, which Microsoft addressed during February’s Patch Tuesday. While the original patch blocked the initial remote‑code‑execution (RCE) path and prevented a SmartScreen bypass, it failed to fully seal the authentication‑coercion vector. During post‑patch testing, Dahan’s team observed that victim machines continued to authenticate to malicious servers, revealing the lingering zero‑click exposure.
Connection to Russian APT28 and Prior Attacks
CVE‑2026‑21510 was actively exploited in January 2026 by the Russian cyber‑espionage group APT28 (also known as Fancy Bear). According to Akamai, citing Ukraine’s Computer Emergency Response Team, APT28 used the flaw in campaigns against Ukrainian governmental bodies and several European Union member states. The attackers delivered a weaponized LNK file via a phishing email masquerading as a notice from Ukraine’s hydro‑meteorological center, chaining it with another vulnerability (CVE‑2026‑21513) to bypass defenses and execute code remotely.
Exploitation Chain and Techniques
In the observed attacks, the phishing email contained a malicious LNK file that triggered CVE‑2026‑21513, a flaw allowing the execution of arbitrary code despite SmartScreen protections. This initial code then leveraged the未patched authentication‑coercion path left by the incomplete fix for CVE‑2026‑21510, now identified as CVE‑2026‑32202. By coercing the victim’s system to send its Net‑NTLMv2 hash to an attacker‑controlled server, the intruders could obtain valid credentials, pivot laterally, and exfiltrate sensitive data without any further user action.
Discoverer and Responsible Disclosure
Maor Dahan, a senior security researcher at Akamai, reported the vulnerability to Microsoft through its coordinated vulnerability disclosure program. Microsoft credited Dahan in the CVE announcement and acknowledged that the bug was uncovered while testing the February patches. The responsible disclosure process allowed Microsoft to develop a mitigating update before widespread public exploitation, although subsequent detection by CISA indicates that some threat actors had already begun weaponizing the flaw.
Current Status and Mitigation Recommendations
Microsoft has released a security update that addresses CVE‑2026‑32202; users and administrators are urged to install the latest cumulative update for their Windows version as soon as possible. In addition to patching, organizations should consider disabling automatic processing of LNK files from untrusted sources, employing network‑level restrictions on outbound SMB/NSS authentication, and monitoring for anomalous Net‑NTLMv2 hash transfers. CISA’s KEV entry reinforces the priority of applying the fix before the May 12 deadline for federal entities, while private‑sector firms are advised to follow the same timeline to reduce risk.
Conclusion and Outlook
The discovery of CVE‑2026‑32202 highlights how an incomplete fix for one vulnerability can unintentionally open a new, stealthy attack surface. The zero‑click nature of the flaw makes it particularly dangerous, as it requires no user interaction to harvest credentials that can fuel extensive espionage or data‑theft operations. While the exact attribution of the ongoing exploitation remains unconfirmed, the historical link to Russian APT28 activities raises concerns about state‑sponsored abuse. Prompt patching, heightened vigilance toward LNK‑based phishing, and adherence to CISA’s guidance are essential steps to mitigate the risk posed by this authentication‑coercion vulnerability.