[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbsT3MBlO1Rr6pG6hrOmLDkKvk6WYpjiZ2jc1DblOyww":3},{"article":4,"iocs":51,"watch_terms":62,"solutions":63,"lesson":32},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"fe485865-644b-44bc-99be-a19e996240be","Incomplete Windows Patch Opens Door to Zero-Click Attacks","incomplete-windows-patch-opens-door-to-zero-click-attacks-f4ab17","The initial vulnerability was exploited by Russia-linked APT28 in attacks against Ukraine and EU countries. The post Incomplete Windows Patch Opens Door to Zero-Click Attacks appeared first on SecurityWeek.","An incomplete Microsoft patch for CVE-2026-21510 left a critical authentication coercion vulnerability (CVE-2026-32202) that allows zero-click credential theft via LNK files. Russia-linked APT28 exploited a chain of flaws (CVE-2026-21510, CVE-2026-21513, CVE-2026-32202) in December 2025 to bypass Windows security features and achieve RCE against targets in Ukraine and EU countries. Microsoft patched CVE-2026-32202 in April 2026, but the incident highlights risks of incomplete security fixes.","Incomplete Windows patch creates zero-click attack chain exploited by APT28 against Ukraine and EU.","https:\u002F\u002Fwww.securityweek.com\u002Fincomplete-windows-patch-opens-door-to-zero-click-attacks\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F10\u002FWindows-Kernel-BSOD.jpg","2026-04-27T13:09:27+00:00","2026-04-27T14:00:13.715027+00:00",9,[17,20,23,25,28],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"Windows SmartScreen","product",{"name":24,"type":22},"MSHTML",{"name":26,"type":27},"APT28","threat_actor",{"name":29,"type":19},"Akamai","574f766a-fb3f-487c-8d2c-0720ae75471b",{"id":30,"icon":32,"name":33,"slug":34},null,"Zero-day","zero-day",[36,41,46],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",[52,56,59],{"type":53,"value":54,"context":55},"cve","CVE-2026-21510","Windows SmartScreen and Shell bypass, RCE if user opens malicious LNK\u002Fshortcut file",{"type":53,"value":57,"context":58},"CVE-2026-21513","MSHTML framework security feature bypass, chained with CVE-2026-21510",{"type":53,"value":60,"context":61},"CVE-2026-32202","Authentication coercion vulnerability from incomplete patch, zero-click credential theft via LNK auto-parsing",[18,29,21],{"controls":64,"vendors":150},[65,93,121],{"slug":66,"name":67,"problem":68,"products":69},"patch-management","Automated patch management","Known holes get closed in days, not months.",[70,78,85],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":66,"product_name":82,"url":83,"description":84},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":94,"name":95,"problem":96,"products":97},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[98,105,113],{"vendor_slug":99,"vendor_name":18,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":122,"name":123,"problem":124,"products":125},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[126,134,142],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",[151,156],{"slug":152,"name":29,"logo_path":153,"roles":154},"akamai","\u002Fvendor-logos\u002Fakamai.png",[155],"reported_by",{"slug":99,"name":18,"logo_path":100,"roles":157},[158],"affected"]