Windows Shell shortcut-file spoofing flaw CVE-2026-32202 used in attacks; fixed in April 2026 updates
A Windows Shell flaw (CVE-2026-32202) lets a booby-trapped shortcut file make your PC send a sign-in hash to an attacker. It is being used in attacks. Fixed in Microsoft's April 2026 updates: install the latest Windows updates.
Run Windows Update and install the latest cumulative update (April 2026 or later). Family PCs on Windows 11 24H2 or 25H2 need build 10.0.26100.8875 or 10.0.26200.8875, or newer.
- Windows 11 25H2fixed in 10.0.26200.8875 and later
- Windows 11 24H2fixed in 10.0.26100.8875 and later
- Windows 11 23H2fixed in 10.0.22631.7376 and later
- Windows 10 22H2fixed in 10.0.19045.7548 and later
- Windows 10 21H2fixed in 10.0.19044.7548 and later
- Windows 10 1809fixed in 10.0.17763.9020 and later
- Windows 10 1607fixed in 10.0.14393.9339 and later
What’s happening
CVE-2026-32202 is a flaw in Windows Shell, the part of Windows that shows files and folders. It is a protection mechanism failure that lets an attacker spoof something over a network. A booby-trapped shortcut (LNK) file can make Windows Explorer reach out to an attacker's server when someone merely opens the folder holding it. That sends the person's Net-NTLMv2 sign-in hash, which can then be cracked or relayed to other systems. Microsoft released a fix on 14 April 2026 but did not initially mark it as exploited. CISA added it to its list of flaws used in attacks on 28 April 2026, and Microsoft confirmed exploitation. It exists because Microsoft's February 2026 fix for CVE-2026-21510 stopped code running but not the outbound connection. That earlier flaw was used by the Russian group APT28; reports do not name who is using this one. It is rated medium (CVSS 4.3). Fixes exist for the Windows 10 and Windows 11 builds listed by CISA; reports also say supported Windows Server versions are affected. I could not read Microsoft's own advisory page, so the list of fixed builds comes from CISA's entry.
- What
- Flaw
- Affects
- Microsoft Windows 10 and 11 (Windows Shell)
- Affected
- Windows 10 Version 1607 (below 10.0.14393.9339)
Windows 10 Version 1809 (below 10.0.17763.9020)
Windows 10 Version 21H2 (below 10.0.19044.7548)
Windows 10 Version 22H2 (below 10.0.19045.7548)
Windows 11 version 23H2 (below 10.0.22631.7376)
Windows 11 Version 24H2 (below 10.0.26100.8875)
Windows 11 Version 25H2 (below 10.0.26200.8875) - Fixed in
- 10.0.14393.9339
10.0.17763.9020
10.0.19044.7548
10.0.19045.7548
10.0.22631.7376
10.0.26100.8875
10.0.26200.8875 - Since
- 14 Apr 2026
- Closed
- 18 May 2026
Timeline
- Update
Security firm Vicarius published a mitigation script for the flaw, rating it CVSS 4.3. The page does not say whether the flaw is exploited.
- CISA added
CISA added CVE-2026-32202 to its list of flaws being used in attacks. Microsoft also confirmed active exploitation, after first publishing the fix without that warning.
- New fixFixed
Microsoft released a fix for CVE-2026-32202, a Windows Shell spoofing flaw, in its April 2026 updates. It was not flagged as exploited at the time. The flaw came from an incomplete February 2026 fix for CVE-2026-21510.
Sources
- Microsoft Security Update Guide: CVE-2026-32202Microsoft · 14 Apr 2026
- CISA, Microsoft warn of active exploitation of Windows Shell vulnerability (CVE-2026-32202)Help Net Security · 29 Apr 2026
- CVE-2026-32202 mitigation script: spoofing vulnerability in Windows ShellVicarius · 18 May 2026