[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9tl7SXqPANS9XMFJvZM8aJgS1d5qXTUFAFvw0NKadsA":3},{"article":4,"iocs":51,"watch_terms":62,"solutions":63,"lesson":32},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"c62e6a42-0efd-474b-8040-12a0d5d40bbe","Microsoft Confirms Active Exploitation of Windows Shell CVE-2026-32202","microsoft-confirms-active-exploitation-of-windows-shell-cve-2026-32202-6db151","Microsoft on Monday revised its advisory for a now-patched, high-severity security flaw impacting Windows Shell to acknowledge that it has been actively exploited in the wild. The vulnerability in question is CVE-2026-32202 (CVSS score: 4.3), a spoofing vulnerability that could allow an attacker to access sensitive information. It was addressed as part of its Patch Tuesday update for this","Microsoft acknowledged active in-the-wild exploitation of CVE-2026-32202, a high-severity Windows Shell spoofing vulnerability (CVSS 4.3) patched in April 2026. The flaw stems from an incomplete patch for CVE-2026-21510 and is being weaponized by Russian APT28 in a zero-click credential theft attack chain targeting Ukraine and EU nations since December 2025. The attack uses malicious LNK files to bypass Microsoft Defender SmartScreen and coerce NTLM authentication, enabling credential harvesting for relay attacks.","Microsoft confirms active exploitation of Windows Shell spoofing flaw CVE-2026-32202 by APT28.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F04\u002Fmicrosoft-confirms-active-exploitation.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiMPU-2lLUg__kJUnPm1HSRP0cTelgKBaXgKDq4ODhX0XTKI83sddz2F_EHiOmoxnTYIkIFYIbFh8JLAMp6lqfK39czq_e1G5Ixe-Y53_-kXBSk0fqVZV6jFpECe1JjAy3ZD3MmnJ71jpZHuPpbNRjB4x7SsmfHNUCMVyzQiST7CTc9m3qteMc4zJ2U_GXo\u002Fs1600\u002Fwindows-exploit.jpg","2026-04-28T05:50:00+00:00","2026-04-28T08:00:19.460448+00:00",9,[17,20,23,25,28],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"Windows Shell","product",{"name":24,"type":22},"Microsoft Defender SmartScreen",{"name":26,"type":27},"APT28","threat_actor",{"name":29,"type":19},"Akamai","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,41,46],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52,56,59],{"type":53,"value":54,"context":55},"cve","CVE-2026-32202","Windows Shell spoofing vulnerability; CVSS 4.3; actively exploited; incomplete patch",{"type":53,"value":57,"context":58},"CVE-2026-21510","Windows Shell protection mechanism failure; CVSS 8.8; fixed February 2026; basis of exploit chain",{"type":53,"value":60,"context":61},"CVE-2026-21513","MSHTML Framework protection mechanism failure; CVSS 8.8; fixed February 2026; part of APT28 chain",[18,29,21],{"controls":64,"vendors":148},[65,93,122],{"slug":66,"name":67,"problem":68,"products":69},"patch-management","Automated patch management","Known holes get closed in days, not months.",[70,77,85],{"vendor_slug":71,"vendor_name":18,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":94,"name":95,"problem":96,"products":97},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[98,106,114],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"slug":123,"name":124,"problem":125,"products":126},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[127,135,140],{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":71,"vendor_name":18,"vendor_logo":72,"product_slug":136,"product_name":137,"url":138,"description":139},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",[149,154],{"slug":150,"name":29,"logo_path":151,"roles":152},"akamai","\u002Fvendor-logos\u002Fakamai.png",[153],"reported_by",{"slug":71,"name":18,"logo_path":72,"roles":155},[156],"affected"]