Microsoft Confirms Active Exploitation of Windows Shell CVE-2026-32202
Microsoft confirms active exploitation of Windows Shell spoofing flaw CVE-2026-32202 by APT28.
Microsoft acknowledged active in-the-wild exploitation of CVE-2026-32202, a high-severity Windows Shell spoofing vulnerability (CVSS 4.3) patched in April 2026. The flaw stems from an incomplete patch for CVE-2026-21510 and is being weaponized by Russian APT28 in a zero-click credential theft attack chain targeting Ukraine and EU nations since December 2025. The attack uses malicious LNK files to bypass Microsoft Defender SmartScreen and coerce NTLM authentication, enabling credential harvesting for relay attacks.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
What helps against this
How we list vendors
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-32202
- cve — CVE-2026-21510
- cve — CVE-2026-21513