Microsoft confirms active exploitation of Windows Shell CVE-2026-32202, a critical zero-click vulnerability allowing attackers to bypass security.

Sources:

Microsoft has confirmed the active exploitation of CVE-2026-32202, a critical zero-click vulnerability in Windows Shell, allowing cybercriminals, including the notorious APT28 group, to bypass security measures effortlessly.

Despite a patch released in April 2026, Akamai researchers reported that victim machines continued authenticating to attackers' servers even after the update. This raises serious concerns over the effectiveness of Microsoft's fixes. The vulnerability, which enables NTLM relay attacks without user interaction, poses a significant threat as it exploits an incomplete security patch.

The flaw allows malicious actors to use a compromised file, potentially leading to severe repercussions. As threats evolve, experts warn that organizations must act swiftly to address this critical vulnerability and safeguard their systems.

Entities have been advised to apply the latest updates immediately to mitigate risks against this sophisticated method of attack. Microsoft's measures, while an attempt to resolve the issues, may still leave systems exposed to further breaches, highlighting a pressing need for ongoing vigilance in cybersecurity strategies.

Sources:

Microsoft has confirmed that a critical zero-click vulnerability in Windows Shell, labeled CVE-2026-32202, is actively being exploited, allowing destructive cyberattacks. Despite a recent patch, threats from the APT28 cyber gang persist, underscoring the urgency for organizations to apply recommended updates immediately.

Microsoft Confirms Windows Shell Exploitation

Key Facts

Microsoft confirmed the active exploitation of Windows Shell CVE-2026-32202, a critical zero-click vulnerability that allows attackers to bypass security features.
The zero-click vulnerability has been characterized as allowing an attacker to establish a connection with a server without requiring user interaction beyond navigating to a compromised folder.
A critical zero-click authentication coercion vulnerability is tracked as CVE-2026-32202 and stems from an incomplete patch for a Windows Shell security feature that was weaponized by the Russian APT28 threat group.

Background on the Vulnerability and Recent Exploitation

Key Facts

The vulnerability is being actively targeted, with malicious actors exploiting the spoofing vulnerability in Windows Shell for attacks.
Akamai researchers observed that even after the patch was applied, victim machines continued to authenticate to an attacker's server.
Organizations are advised to apply remediation measures for CVE-2026-32202 immediately.

Microsoft confirms active exploitation of Windows Shell CVE-2026-32202, a critical zero-click vulnerability allowing attackers to bypass security.

Microsoft Confirms Windows Shell Exploitation

Background on the Vulnerability and Recent Exploitation

Article

Source Citations