{"id":"windows-shell-lnk-spoofing-cve-2026-32202-apr","category":"patch","status":"closed","title":"Windows Shell shortcut-file spoofing flaw CVE-2026-32202 used in attacks; fixed in April 2026 updates","tldr":"A Windows Shell flaw (CVE-2026-32202) lets a booby-trapped shortcut file make your PC send a sign-in hash to an attacker. It is being used in attacks. Fixed in Microsoft's April 2026 updates: install the latest Windows updates.","summary":"CVE-2026-32202 is a flaw in Windows Shell, the part of Windows that shows files and folders. It is a protection mechanism failure that lets an attacker spoof something over a network. A booby-trapped shortcut (LNK) file can make Windows Explorer reach out to an attacker's server when someone merely opens the folder holding it. That sends the person's Net-NTLMv2 sign-in hash, which can then be cracked or relayed to other systems. Microsoft released a fix on 14 April 2026 but did not initially mark it as exploited. CISA added it to its list of flaws used in attacks on 28 April 2026, and Microsoft confirmed exploitation. It exists because Microsoft's February 2026 fix for CVE-2026-21510 stopped code running but not the outbound connection. That earlier flaw was used by the Russian group APT28; reports do not name who is using this one. It is rated medium (CVSS 4.3). Fixes exist for the Windows 10 and Windows 11 builds listed by CISA; reports also say supported Windows Server versions are affected. I could not read Microsoft's own advisory page, so the list of fixed builds comes from CISA's entry.","action":"Run Windows Update and install the latest cumulative update (April 2026 or later). Family PCs on Windows 11 24H2 or 25H2 need build 10.0.26100.8875 or 10.0.26200.8875, or newer.","product":"Microsoft Windows 10 and 11 (Windows Shell)","audience":"both","severity":"medium","patch":"patched","exploited":true,"cves":["CVE-2026-32202"],"tags":["microsoft","windows","windows-shell","zero-day","lnk","ntlm","cisa-kev","spoofing"],"affected":["Windows 10 Version 1607 (below 10.0.14393.9339)","Windows 10 Version 1809 (below 10.0.17763.9020)","Windows 10 Version 21H2 (below 10.0.19044.7548)","Windows 10 Version 22H2 (below 10.0.19045.7548)","Windows 11 version 23H2 (below 10.0.22631.7376)","Windows 11 Version 24H2 (below 10.0.26100.8875)","Windows 11 Version 25H2 (below 10.0.26200.8875)"],"fixed":["10.0.14393.9339","10.0.17763.9020","10.0.19044.7548","10.0.19045.7548","10.0.22631.7376","10.0.26100.8875","10.0.26200.8875"],"matches":[{"platform":"windows","app":"Windows 11 25H2","bundle":"","fixed":"10.0.26200.8875"},{"platform":"windows","app":"Windows 11 24H2","bundle":"","fixed":"10.0.26100.8875"},{"platform":"windows","app":"Windows 11 23H2","bundle":"","fixed":"10.0.22631.7376"},{"platform":"windows","app":"Windows 10 22H2","bundle":"","fixed":"10.0.19045.7548"},{"platform":"windows","app":"Windows 10 21H2","bundle":"","fixed":"10.0.19044.7548"},{"platform":"windows","app":"Windows 10 1809","bundle":"","fixed":"10.0.17763.9020"},{"platform":"windows","app":"Windows 10 1607","bundle":"","fixed":"10.0.14393.9339"}],"sources":[{"kind":"advisory","title":"Microsoft Security Update Guide: CVE-2026-32202","url":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-32202","by":"Microsoft","date":"2026-04-14"},{"kind":"news","title":"CISA, Microsoft warn of active exploitation of Windows Shell vulnerability (CVE-2026-32202)","url":"https://www.helpnetsecurity.com/2026/04/29/windows-cve-2026-32202-exploited/","by":"Help Net Security","date":"2026-04-29"},{"kind":"research","title":"CVE-2026-32202 mitigation script: spoofing vulnerability in Windows Shell","url":"https://www.vicarius.io/vsociety/posts/cve-2026-32202-mitigation-script-spoofing-vulnerability-in-windows-shell","by":"Vicarius","date":"2026-05-18"}],"started":"2026-04-14","closed":"2026-05-18","created":"2026-11-03T22:02:08.674Z","updated":"2026-11-03T22:02:08.674Z","cve_notes":[{"cve":"CVE-2026-32202","name":"Spoofing flaw in Windows Shell shortcut handling","what":"A protection mechanism failure in Windows Shell that lets an attacker use a booby-trapped shortcut file to make a PC contact the attacker's server and hand over a sign-in hash, with no click needed beyond opening the folder.","severity":"medium","cvss":4.3}],"timeline":[{"at":"2026-05-18","added":"2026-11-03T22:00:26.134Z","kind":"other","text":"Security firm Vicarius published a mitigation script for the flaw, rating it CVSS 4.3. The page does not say whether the flaw is exploited.","url":"https://www.vicarius.io/vsociety/posts/cve-2026-32202-mitigation-script-spoofing-vulnerability-in-windows-shell","by":"Vicarius","patch":null},{"at":"2026-04-28","added":"2026-11-03T22:00:26.134Z","kind":"cisa-added","text":"CISA added CVE-2026-32202 to its list of flaws being used in attacks. Microsoft also confirmed active exploitation, after first publishing the fix without that warning.","url":"https://www.helpnetsecurity.com/2026/04/29/windows-cve-2026-32202-exploited/","by":"Help Net Security","patch":null},{"at":"2026-04-14","added":"2026-11-03T22:00:26.134Z","kind":"new-fix","text":"Microsoft released a fix for CVE-2026-32202, a Windows Shell spoofing flaw, in its April 2026 updates. It was not flagged as exploited at the time. The flaw came from an incomplete February 2026 fix for CVE-2026-21510.","url":"https://www.helpnetsecurity.com/2026/04/29/windows-cve-2026-32202-exploited/","by":"Help Net Security","patch":"patched"}],"url":"https://hard.fyi/live/windows-shell-lnk-spoofing-cve-2026-32202-apr/","json":"https://hard.fyi/api/live?id=windows-shell-lnk-spoofing-cve-2026-32202-apr"}