CVE-2026-32202 — Windows Shell Protection Mechanism Failure: NTLM Authentication Coercion via Auto-Parsed LNK Files (CISA KEV)
CVE-2026-32202 (TL-2026-0435), also tracked as Windows Shell LNK NTLM Coercion, is a critical-severity software vulnerability scored CVSS 4.3, first published 2026-04-29. It has no confirmed attribution, affects Microsoft Windows 10 1607, references 3 CVEs (CVE-2026-32202, CVE-2026-21510, CVE-2026-21513), maps to 20 MITRE ATT&CK techniques (T1003.005, T1021.002, T1027.006), and is covered by 9 detection rules and 16 indicators of compromise.
Key facts for TL-2026-0435
- Threat ID
- TL-2026-0435
- Also known as
- Windows Shell LNK NTLM Coercion, Akamai LNK Bypass, CVE-2026-21510 Patch Bypass
- Severity
- CRITICAL
- CVSS
- 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-04-29
- Last reviewed
- 2026-04-29
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- government, federal-civilian, defense, financial, energy, healthcare, critical-infrastructure, education, technology
- Target regions
- North America, Europe, Ukraine, European Union
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in CVE-2026-32202
Malware and tooling: Coercer.py (p0dalirius/Coercer), Impacket ntlmrelayx.py, Inveigh / InveighZero, Responder - S0174, WebDAV listener on attacker host (e.g., Apache mod_dav, wsgidav, custom Python http.server with PROPFIND handler) bound to TCP/80 or TCP/443
CVE-2026-32202 is an actively exploited Windows Shell protection-mechanism-failure (CWE-693) that allows a remote unauthenticated attacker to coerce NTLM authentication when a victim merely views a folder containing a weaponized LNK shortcut. Discovered by Akamai as a residual bypass of Microsoft's February 2026 patch for CVE-2026-21510, the flaw was patched on April 14, 2026 and added to the CISA Known Exploited Vulnerabilities catalog on April 28, 2026 with an FCEB remediation deadline of May 12, 2026. The predecessor CVE-2026-21510 was previously weaponized by Russian APT28 (Fancy Bear / UAC-0001) against Ukrainian and EU government targets; whether the same actor is responsible for the current in-the-wild CVE-2026-32202 exploitation remains publicly unconfirmed.
How CVE-2026-32202 works
CVE-2026-32202 is a Windows Shell protection mechanism failure vulnerability (CWE-693) that enables remote spoofing and NTLM authentication coercion against any Windows endpoint where Explorer or any process invoking SHParseDisplayName / IShellLink::Resolve auto-parses an attacker-controlled LNK shortcut. Microsoft assigned the CVE on April 14, 2026 (April Patch Tuesday) after Akamai researchers identified that the February 2026 fix for the predecessor RCE CVE-2026-21510 left a residual code path in shell32.dll that still resolves UNC targets embedded in LNK metadata (icon path, working directory, target path) without enforcing the patched protection check. CISA added the issue to the Known Exploited Vulnerabilities (KEV) catalog on April 28, 2026 with a Federal Civilian Executive Branch remediation deadline of May 12, 2026 under Binding Operational Directive 22-01.
Exploitation chain: an attacker delivers a weaponized .lnk file via spearphishing attachment, malicious link, HTML smuggling, USB drop, or compromised file share. The LNK contains an embedded UNC path (\\attacker-host\share\icon.ico or http(s)-prefixed WebDAV URL). When Windows Explorer renders the containing folder — including via the Preview Pane, Quick Look in File Open dialogs, or background icon-cache rebuilds — the Shell automatically resolves the UNC reference. This triggers the WebClient (WebDAV) service or SMB redirector to perform an outbound NTLM challenge-response handshake to the attacker, leaking the user's NTLMv2 hash. The attacker can then crack the hash offline, or relay it in real time (e.g., Impacket ntlmrelayx) against a target service that does not enforce SMB signing or EPA, achieving lateral movement, mailbox access, ADCS certificate issuance, or domain takeover.
NVD scores the issue CVSS 3.1 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). Threadlinqs Intelligence assigns CRITICAL severity due to (1) automatic CISA KEV inclusion with active in-the-wild exploitation, (2) a federal patch mandate, (3) a documented incomplete-patch lineage with a previously weaponized RCE predecessor, and (4) the credential-relay impact chain that converts the low-impact spoofing primitive into full domain compromise.
Affected platforms: Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, 2025. Microsoft's April 2026 cumulative updates ship the corrected protection check; build floors are listed in the affected_json field.
Defenders should: (1) deploy the April 2026 Microsoft cumulative updates immediately; (2) block outbound SMB (TCP/445) and WebDAV (port 80/443 to public destinations from end-user workstations) at the perimeter and host firewall; (3) disable the WebClient service where business need is absent; (4) enforce SMB signing and Extended Protection for Authentication on all internal services; (5) deploy Defender ASR rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)" in Block mode; (6) hunt for explorer.exe → outbound 445 or unauthenticated WebDAV PROPFIND telemetry. Detection coverage from @Detector covers Splunk SPL, Microsoft Sentinel KQL, and Sigma + CQL/Cortex variants. Pentester-supplied simulation steps cover Atomic Red Team T1187 forced-authentication exercises and Impacket-based relay validation.
MITRE ATT&CK techniques used in TL-2026-0435
Credential Access
T1003.005 OS Credential Dumping: Cached Domain Credentials; T1187 Forced Authentication; T1557.001 Name Resolution Poisoning and SMB Relay
Lateral Movement
T1021.002 Remote Services: SMB/Windows Admin Shares; T1550.002 Use Alternate Authentication Material: Pass the Hash; T1570 Lateral Tool Transfer
Defense Evasion
T1027.006 Obfuscated Files or Information: HTML Smuggling; T1036.005 Match Legitimate Resource Name or Location; T1564.001 Hide Artifacts: Hidden Files and Directories
Command and Control
T1071.002 Application Layer Protocol: File Transfer Protocols; T1105 Ingress Tool Transfer
Discovery
T1083 File and Directory Discovery
Initial Access
T1091 Replication Through Removable Media; T1189 Drive-by Compromise; T1566 Phishing; T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link
Execution
T1204 User Execution; T1204.001 User Execution: Malicious Link; T1204.002 User Execution: Malicious File
Affected products and versions in CVE-2026-32202
- Microsoft — Windows 10 1607
Vulnerable versions: < 10.0.14393.9060
Fixed in: 10.0.14393.9060 - Microsoft — Windows 10 1809
Vulnerable versions: < 10.0.17763.8644
Fixed in: 10.0.17763.8644 - Microsoft — Windows 10 21H2
Vulnerable versions: < 10.0.19044.7184
Fixed in: 10.0.19044.7184 - Microsoft — Windows 10 22H2
Vulnerable versions: < 10.0.19045.7184
Fixed in: 10.0.19045.7184 - Microsoft — Windows 11 23H2
Vulnerable versions: < 10.0.22631.6936
Fixed in: 10.0.22631.6936 - Microsoft — Windows 11 24H2
Vulnerable versions: < 10.0.26100.8246
Fixed in: 10.0.26100.8246 - Microsoft — Windows 11 25H2
Vulnerable versions: < 10.0.26200.8246
Fixed in: 10.0.26200.8246 - Microsoft — Windows 11 26H1
Vulnerable versions: < 10.0.28000.1836
Fixed in: 10.0.28000.1836 - Microsoft — Windows Server 2012
Vulnerable versions: RTM
Fixed in: April 2026 monthly rollup (ESU) - Microsoft — Windows Server 2012 R2
Vulnerable versions: all
Fixed in: April 2026 monthly rollup (ESU)
Remediation for CVE-2026-32202
Patches
- Windows 10 1607 / Server 2016: build 10.0.14393.9060 or later (April 2026 cumulative).
- Windows 10 1809 / Server 2019: build 10.0.17763.8644 or later.
- Windows 10 21H2: build 10.0.19044.7184 or later.
- Windows 10 22H2: build 10.0.19045.7184 or later.
- Windows 11 23H2: build 10.0.22631.6936 or later.
- Windows 11 24H2: build 10.0.26100.8246 or later.
- Windows 11 25H2: build 10.0.26200.8246 or later.
- Windows 11 26H1: build 10.0.28000.1836 or later.
- Windows Server 2022: build 10.0.20348.5020 or later.
- Windows Server 2022 23H2: build 10.0.25398.2274 or later.
Immediate actions
- Apply the April 2026 Microsoft cumulative update for the affected SKU (build floors in affected_json).
- Block outbound TCP/445 (SMB) from end-user subnets to all non-RFC1918 destinations at perimeter and host firewall.
- Block outbound TCP/80 and TCP/443 WebDAV PROPFIND/OPTIONS from end-user workstations to non-allowlisted destinations.
- Disable the WebClient (WebDAV mini-redirector) service on workstations and servers where there is no documented business requirement.
- Enable Microsoft Defender ASR rules: Block credential stealing from LSASS, Block all Office applications from creating child processes, Block executable content from email client and webmail.
Workarounds
- Set Group Policy 'Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers' to 'Deny all' (test for application breakage first).
- Disable preview pane and details pane in Windows Explorer via GPO to reduce auto-parse exposure.
- Block file extensions .lnk, .url, .scf, .library-ms at the email gateway and at the SMB share level for user-uploaded content.
- Set HKLM\SYSTEM\CurrentControlSet\Services\WebClient\Parameters\BasicAuthLevel = 0 and WebDAV BasicAuthLevel registry to suppress WebDAV authentication.
Longer-term hardening
- Enforce SMB signing (required) on all servers and workstations via Group Policy.
- Enable Extended Protection for Authentication (EPA) on AD CS, Exchange, LDAP-S, and IIS endpoints to defeat NTLM relay.
- Migrate from NTLM to Kerberos-only authentication where feasible; audit and remove NTLM dependencies.
- Deploy LDAP channel binding and signing enforcement (RFC 2829) on all domain controllers.
- Roll out Credential Guard and Remote Credential Guard on all eligible endpoints.
- Segment user workstations from server VLANs; require jump-host access for administrative SMB.
- Deploy EDR with behavioral detection for explorer.exe initiating outbound NTLM authentication.
CVEs associated with CVE-2026-32202
Weaknesses (CWE) in CVE-2026-32202
CWE-693, CWE-294, CWE-522
Timeline of CVE-2026-32202
- Microsoft publishes CVE-2026-21510 (Windows Shell RCE, CVSS 8.8). CISA adds it to the KEV catalog the same day with a 2026-03-03 FCEB remediation deadline.
- Reports surface that Russian APT28 (Fancy Bear / UAC-0001) is exploiting CVE-2026-21510 against Ukrainian and EU government targets via spearphishing-delivered LNK attachments.
- Akamai security researchers begin systematic analysis of the February 2026 CVE-2026-21510 patch and identify a residual code path in shell32.dll that still resolves UNC-prefixed LNK metadata without enforcing the corrected protection check.
- Akamai privately discloses the patch bypass to Microsoft Security Response Center under coordinated vulnerability disclosure.
- Microsoft assigns CVE-2026-32202 and ships fixes in the April 2026 cumulative updates across Windows 10, Windows 11, and Windows Server 2012 through 2025. NVD initial scoring: CVSS 4.3 MEDIUM (CWE-693, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).
- Microsoft Threat Intelligence reports first in-the-wild exploitation of CVE-2026-32202 against unpatched endpoints. Attribution remains undisclosed at time of publication.
- CISA adds CVE-2026-32202 to the Known Exploited Vulnerabilities catalog under 'Microsoft Windows Protection Mechanism Failure Vulnerability' and sets FCEB remediation deadline to 2026-05-12 under BOD 22-01.
- BleepingComputer publishes coverage detailing CISA's directive and the Akamai-discovered patch-bypass lineage. Security teams across federal civilian agencies, financial services, and critical infrastructure begin emergency patch cycles.
- Federal Civilian Executive Branch agencies must complete remediation of CVE-2026-32202 in production environments under CISA Binding Operational Directive 22-01.
- As of 2026-05-29, CVE-2026-32202 remains a live concern: Microsoft (advisory corrected Apr 27) and CISA KEV (added Apr 28, FCEB deadline May 12) confirm in-the-wild zero-click NTLM-coercion exploitation, attributed by Akamai/reporting to Russia's APT28. A patch shipped Apr 14 2026 but no successor fix supersedes it, the actor is undisrupted, and unpatched endpoints stay exploitable.
Sources cited for CVE-2026-32202
- Microsoft Security Response Center — CVE-2026-32202
- NVD — CVE-2026-32202
- CISA Known Exploited Vulnerabilities Catalog — CVE-2026-32202
- CISA Binding Operational Directive 22-01
- BleepingComputer — CISA orders feds to patch Windows flaw exploited as zero-day
- Microsoft Security Response Center — CVE-2026-21510 (predecessor RCE)
- NVD — CVE-2026-21510 (predecessor)
- NVD — CVE-2026-21513 (related MSHTML protection bypass)
- MITRE ATT&CK — T1187 Forced Authentication
- MITRE ATT&CK — T1557.001 LLMNR/NBT-NS Poisoning and SMB Relay
Threats related to CVE-2026-32202
Detection coverage for TL-2026-0435
As of 2026-04-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0435 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.