Windows Shell CVE-2026-32202 KEV: Zero-Click NTLM Coercion

Suspected

Discovered May 27, 2026

CVE-2026-32202 is an actively exploited Windows Shell protection-mechanism failure that Akamai traced to an incomplete patch for an APT28 LNK exploit chain, allowing zero-click NTLM authentication coercion when Explorer renders a malicious shortcut.

Affected Packages

Observables

Sources

Defender Action Panel

Triage this incident quickly

Check whether your environment installed affected software, copy the top IOCs, run the tested hunting script when available, then review remediation guidance.

Am I affected?: Review affected software below
Immediate action: Audit locks, CI runners, developer workstations, and credential exposure.
Hunting: Has hunting script

Copy IOCs Run hunting script View sources Jump to remediation

hXXps://nvd[.]nist[.]gov/vuln/detail/CVE-2026-32202
hXXps://www[.]cisa[.]gov/news-events/alerts/2026/04/28/cisa-adds-two-known-exploited-vulnerabilities-catalog
hXXps://www[.]akamai[.]com/blog/security-research/2026/apr/incomplete-patch-apt28s-zero-day-cve-2026-32202

Analysis

Executive Summary

CVE-2026-32202 is a Windows Shell protection-mechanism failure that turns normal folder rendering into a credential-exposure path. Akamai found it while analyzing Microsoft's patch for an APT28-linked LNK exploit chain: the February fix blocked the earlier remote code execution and SmartScreen bypass path, but Windows Explorer could still resolve a UNC path while extracting shortcut resources, causing a victim host to authenticate to an attacker-controlled SMB server without a click Akamai opens in a new tab.

CISA added CVE-2026-32202 to the Known Exploited Vulnerabilities catalog on 2026-04-28, with a federal remediation due date of 2026-05-12 CISA opens in a new tab. The NVD entry also marks the CVE as present in CISA KEV and links to Microsoft and Akamai advisories NVD opens in a new tab.

The immediate risk is Net-NTLMv2 capture and relay. A mailbox, archive share, developer download folder, ticket attachment, or synced cloud directory that contains a crafted .lnk can trigger outbound authentication as soon as Explorer previews or renders the folder. Treat exposure as credential theft until SMB egress, NTLM relay paths, and affected accounts are ruled out.

Key Facts

Cve: CVE-2026-32202

Vendor: Microsoft

Product: Windows Shell

Vulnerability Name: Microsoft Windows Protection Mechanism Failure Vulnerability

Kev Added: 2026-04-28

Kev Due Date: 2026-05-12

Exploitation Status: CISA KEV / active exploitation reported

Root Cause Summary: incomplete patch left UNC path resolution before trust verification

Primary Trigger: Explorer renders a malicious LNK / Shell Link target containing a UNC path

Credential At Risk: Net-NTLMv2 authentication material

Related Chain:

CVE-2026-21510
CVE-2026-21513

Attacker Context:

APT28-linked LNK exploitation chain reported by Akamai and CERT-UA context

Affected Assets:

Windows endpoints
Windows servers where users browse attacker-controlled folders or attachments
VDI and jump hosts with outbound SMB permitted

Last Verified: 2026-05-27

Evidence Assessment

confirmed: Akamai reports that CVE-2026-32202 resulted from an incomplete patch for CVE-2026-21510, leaving zero-click authentication coercion through Windows Shell resource resolution Akamai opens in a new tab.
confirmed: Akamai states the earlier exploit chain was detected in January 2026 and that CVE-2026-21513 and CVE-2026-21510 were used in the same LNK file Akamai opens in a new tab.
confirmed: CISA's KEV alert URL for 2026-04-28 identifies CVE-2026-32202 as one of two added exploited vulnerabilities CISA opens in a new tab.
confirmed: NVD lists CVE-2026-32202 and notes its presence in CISA's Known Exploited Vulnerabilities catalog NVD opens in a new tab.
likely: Environments allowing outbound SMB from workstations or VDI to the internet have higher blast radius because captured NTLM material can be relayed or cracked.
unclear: Public sources do not enumerate all campaigns using CVE-2026-32202 after KEV listing.

Impact Determination

Analysis table
Classification	Criteria	Required evidence	Required action	Closure condition
Confirmed compromise	Endpoint opened or rendered a malicious LNK path and initiated SMB/NTLM authentication to an untrusted host.	Sysmon process/file events, Windows Security NTLM events, firewall/proxy logs, SMB server logs, EDR file collection, and the `.lnk` artifact.	Isolate the endpoint, collect the LNK, block outbound SMB, reset affected account credentials, and investigate relay targets.	Patch is installed, no outbound SMB persists, account tokens/passwords are rotated, and relay-sensitive services are hardened.
Presumed exposed	User received or stored suspicious `.lnk` files, browsed attacker-controlled archive/share content, or endpoint allowed outbound SMB during the exposure window.	Mail gateway attachments, downloaded archives, filesystem inventory, firewall policy, and Windows event logs.	Hunt for LNK UNC targets and NTLM outbound events.	No malicious LNK, no outbound SMB, and no suspicious account use are found.
Potentially exposed	Windows endpoint/server fleet status is unknown or missing April 2026 cumulative updates.	Patch inventory and asset records.	Prioritize KEV remediation and run the fleet audit below.	Assets are patched or removed from exposure.
Not exposed	Patched systems have outbound SMB blocked and no suspicious LNK/NTLM telemetry.	Patch compliance export, egress firewall evidence, negative endpoint hunts.	Maintain controls and monitor for LNK attachments.	Evidence is archived with query timestamps.
Unknown	Endpoint logs, firewall logs, or patch inventory are unavailable.	Gap statement identifying missing telemetry.	Apply conservative credential rotation for high-value accounts that used affected hosts.	Missing data is recovered or risk is accepted.

Timeline

2025-12: CERT-UA context cited by Akamai describes APT28 activity using weaponized LNK files against Ukraine and European targets Akamai opens in a new tab.
2026-01: Akamai detects the exploit chain later associated with CVE-2026-21510 and CVE-2026-21513 Akamai opens in a new tab.
2026-02: Microsoft patches the original chain, but Akamai finds the remaining authentication coercion path Akamai opens in a new tab.
2026-04-23: Akamai publishes technical analysis of the incomplete patch and CVE-2026-32202 Akamai opens in a new tab.
2026-04-28: CISA adds CVE-2026-32202 to KEV CISA opens in a new tab.
2026-05-27: This site adds a standalone response article because the CVE was not previously covered locally.

What Happened

The original LNK exploit chain used Windows Shell namespace parsing to load a Control Panel component from a UNC path. Microsoft's patch added trust verification later in the ShellExecute path. Akamai found an earlier branch still caused Windows to resolve the UNC path while Explorer extracted the icon or UI resource for the shortcut. That resolution triggers SMB and an automatic NTLM authentication handshake before the later trust verification can help Akamai opens in a new tab.

The result is zero-click credential coercion. A user does not need to execute the shortcut; viewing a folder containing the malicious LNK can be enough for the host to offer Net-NTLMv2 material to an attacker-controlled server.

Trigger Path

A malicious .lnk embeds shell item data that references a UNC path for a Control Panel-related object. During folder rendering, Windows Explorer asks Shell32 to resolve resources such as icons. Akamai traces the early call path to CControlPanelFolder::GetUIObjectOf and PathFileExistsW, which can resolve the remote path before SmartScreen or Mark-of-the-Web trust checks block later execution Akamai opens in a new tab. [1]

Primary Security Impact

The exposed credential material can support NTLM relay or offline cracking. The practical blast radius depends on whether outbound SMB is permitted, whether SMB signing and EPA are enforced on internal services, and whether the affected user has privileged access. [1]

Why KEV Priority Is Higher Than CVSS

CVE-2026-32202 may appear less urgent if reviewed only through base severity. KEV status changes the decision: exploitation is confirmed, the trigger requires low user interaction in normal file-browsing workflows, and the result can be a credential pivot rather than a single-host crash. [1]

Downstream Abuse Audits

Compromised workstations expose active API credentials, requiring immediate rotated revocation. The following platforms are at risk:

GitHub OIDC and PATs: Attackers harvested SSH private keys and Git Personal Access Tokens. Auditors must inspect recent action runs and release logs during the exposure window.
Cloud IAM Credentials: AWS, Azure, and GCP session tokens. CloudTrail and Activity Logs should be queried for AssumeRole or write operations originating from unexpected IP addresses.
NPM and Package Registries: Publishing tokens and credentials. Registry profiles must be audited for unauthorized version publishes or token additions.

Containment

Apply Microsoft's April 2026 or later security updates that address CVE-2026-32202.
Block outbound SMB and WebDAV from endpoints to the internet. Workstations should not initiate TCP/445 to arbitrary external hosts.
Quarantine suspicious .lnk files and preserve original attachments, archives, and directory listings for evidence.

Eradication

Remove malicious LNK artifacts only after hashing and preserving them.
Audit mailbox, browser download, synced cloud, and shared-drive folders for suspicious shortcuts.
Reset passwords for users whose hosts authenticated to untrusted SMB endpoints.

Recovery

Enforce SMB signing and Extended Protection for Authentication on relay-sensitive services.
Reduce NTLM use where possible and monitor exceptions.
Add mail and web gateway controls for .lnk inside archives and disk images.

Closure Gates

Patch inventory confirms remediation for all affected Windows assets.
No endpoint has outbound SMB to untrusted networks.
All suspicious .lnk files are collected and removed.
Accounts tied to confirmed outbound NTLM coercion are rotated and reviewed for post-exposure activity.

Sources

Timeline

Timeline
Date	Event	Description	Source

May 27, 2026	First seen	First seen recorded for Windows Shell CVE-2026-32202 KEV: Zero-Click NTLM Coercion.	mcnc.org
May 27, 2026	Windows Shell CVE-2026-32202 KEV: Zero-Click NTLM Coercion	Unknown	mcnc.org
May 27, 2026	Discovery	Discovery recorded for Windows Shell CVE-2026-32202 KEV: Zero-Click NTLM Coercion.	mcnc.org
May 27, 2026	Disclosure	Disclosure recorded for Windows Shell CVE-2026-32202 KEV: Zero-Click NTLM Coercion.	mcnc.org

Affected Software

Affected Software
Package	Ecosystem	Version Range	Status	Confidence	Source
No rows match the active filters.

IOC Clipboard

3 IOCs

urlhttps://nvd.nist.gov/vuln/detail/CVE-2026-32202

urlhttps://www.cisa.gov/news-events/alerts/2026/04/28/cisa-adds-two-known-exploited-vulnerabilities-catalog

urlhttps://www.akamai.com/blog/security-research/2026/apr/incomplete-patch-apt28s-zero-day-cve-2026-32202

Tested Hunting Scripts

Tested Hunting Scripts
Title	Language	Description	Repository	Source
local repository and exported telemetry scope	Python	Does the telemetry scope contain patterns associated with Windows Shell CVE-2026-32202 KEV: Zero-Click NTLM Coercion?	scripts/local_repository_and_exported_telemetry_scope.py opens in a new tab	mcnc.org

Hunt Manifest: local repository and exported telemetry scope

Title: local repository and exported telemetry scope
Question: Does the telemetry scope contain patterns associated with Windows Shell CVE-2026-32202 KEV: Zero-Click NTLM Coercion?
Telemetry Family: Python
Repository: scripts/local_repository_and_exported_telemetry_scope.py

Show tested hunting scriptscripts/local_repository_and_exported_telemetry_scope.py

#!/usr/bin/env python3
import os
import sys
from pathlib import Path

ROOT = sys.argv[1] if len(sys.argv) > 1 else "."
LOG_ROOT = os.environ.get("LOG_ROOT", "")
OUT = Path(os.environ.get("OUT", "hp-windows-shell-cve-2026-32202-kev-scope"))

URLS = ["https://www.akamai.com/blog/security-research/2026/apr/incomplete-patch-apt28s-zero-day-cve-2026-32202","https://www.cisa.gov/news-events/alerts/2026/04/28/cisa-adds-two-known-exploited-vulnerabilities-catalog","https://nvd.nist.gov/vuln/detail/CVE-2026-32202"]

# Collect unique indicators
indicators = set()
for group in [URLS]:
    for val in group:
        if val:
            indicators.add(val)

with open(indicators_file, "w") as f:
    for ind in sorted(indicators):
        f.write(ind + "\n")

print(f"[+] Written unique selectors to {indicators_file}")

# Walk local directory
print(f"[+] Scanning directory: {ROOT} for selectors...")
matches = []
exclude_dirs = {"node_modules", "vendor", "dist", ".git"}
for root, dirs, filenames in os.walk(ROOT):
    dirs[:] = [d for d in dirs if d not in exclude_dirs]
    for filename in filenames:
        filepath = Path(root) / filename
        try:
            content = filepath.read_text(errors="ignore")
            for ind in indicators:
                if ind in content:
                    matches.append(f"{filepath}: found '{ind}'")
        except Exception:
            pass  # pass # return or raise not needed here  # pass # return or raise not needed here  # pass # return or raise not needed here

if matches:
    (OUT / "repository-indicator-matches.txt").write_text("\n".join(matches) + "\n")
    print(f"[!] Found {len(matches)} matches in codebase!")

# Optional Log Scanning
if LOG_ROOT and os.path.exists(LOG_ROOT):
    print(f"[+] Scanning telemetry log directory: {LOG_ROOT}...")
    log_matches = []
    for root, _, filenames in os.walk(LOG_ROOT):
        for filename in filenames:
            filepath = Path(root) / filename
            try:
                content = filepath.read_text(errors="ignore")
                for ind in indicators:
                    if ind in content:
                        log_matches.append(f"{filepath}: found '{ind}'")
            except Exception:
                pass  # pass # return or raise not needed here  # pass # return or raise not needed here  # pass # return or raise not needed here
    if log_matches:
        (OUT / "exported-telemetry-indicator-matches.txt").write_text("\n".join(log_matches) + "\n")
        print(f"[!] Found {len(log_matches)} matches in logs!")

    if PACKAGES:
        registry_dir = OUT / "registry"
        registry_dir.mkdir(exist_ok=True)

print(f"[+] Wrote scope artifacts under {OUT}")

Provenance & Sources

Provenance & Sources
Source	Type	Reliability	Claims	Evidence

mcnc.org	Security Researcher	95%	1	CVE-2026-32202 is an actively exploited Windows Shell protection-mechanism failure that Akamai traced to an incomplete patch for an APT28 LNK exploit chain, allowing zero-click NTLM authentication coercion when Explorer renders a malicious shortcut.
nvd.nist.gov	Security Researcher	95%	1	CVE-2026-32202 is an actively exploited Windows Shell protection-mechanism failure that Akamai traced to an incomplete patch for an APT28 LNK exploit chain, allowing zero-click NTLM authentication coercion when Explorer renders a malicious shortcut.
akamai.com	Security Researcher	95%	1	CVE-2026-32202 is an actively exploited Windows Shell protection-mechanism failure that Akamai traced to an incomplete patch for an APT28 LNK exploit chain, allowing zero-click NTLM authentication coercion when Explorer renders a malicious shortcut.
cisa.gov	Security Researcher	95%	1	CVE-2026-32202 is an actively exploited Windows Shell protection-mechanism failure that Akamai traced to an incomplete patch for an APT28 LNK exploit chain, allowing zero-click NTLM authentication coercion when Explorer renders a malicious shortcut.
msrc.microsoft.com	Security Researcher	95%	1	CVE-2026-32202 is an actively exploited Windows Shell protection-mechanism failure that Akamai traced to an incomplete patch for an APT28 LNK exploit chain, allowing zero-click NTLM authentication coercion when Explorer renders a malicious shortcut.