Incomplete Windows Patch Opens Door to Zero-Click Attacks
Incomplete Windows patch creates zero-click attack chain exploited by APT28 against Ukraine and EU.
An incomplete Microsoft patch for CVE-2026-21510 left a critical authentication coercion vulnerability (CVE-2026-32202) that allows zero-click credential theft via LNK files. Russia-linked APT28 exploited a chain of flaws (CVE-2026-21510, CVE-2026-21513, CVE-2026-32202) in December 2025 to bypass Windows security features and achieve RCE against targets in Ukraine and EU countries. Microsoft patched CVE-2026-32202 in April 2026, but the incident highlights risks of incomplete security fixes.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
What helps against this
How we list vendors
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-21510
- cve — CVE-2026-21513
- cve — CVE-2026-32202