CVE-2026-32202 — Windows Shell Protection Mechanism Failure: NTLM Authentication Coercion via Auto-Parsed LNK Files (CISA KEV)

CVE-2026-32202 (TL-2026-0435), also tracked as Windows Shell LNK NTLM Coercion, is a critical-severity software vulnerability scored CVSS 4.3, first published 2026-04-29. It has no confirmed attribution, affects Microsoft Windows 10 1607, references 3 CVEs (CVE-2026-32202, CVE-2026-21510, CVE-2026-21513), maps to 20 MITRE ATT&CK techniques (T1003.005, T1021.002, T1027.006), and is covered by 9 detection rules and 16 indicators of compromise.

Key facts for TL-2026-0435

Threat ID
TL-2026-0435
Also known as
Windows Shell LNK NTLM Coercion, Akamai LNK Bypass, CVE-2026-21510 Patch Bypass
Severity
CRITICAL
CVSS
4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-04-29
Last reviewed
2026-04-29
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
government, federal-civilian, defense, financial, energy, healthcare, critical-infrastructure, education, technology
Target regions
North America, Europe, Ukraine, European Union
Detection rules
9
Indicators of compromise
16

Malware and tooling in CVE-2026-32202

Malware and tooling: Coercer.py (p0dalirius/Coercer), Impacket ntlmrelayx.py, Inveigh / InveighZero, Responder - S0174, WebDAV listener on attacker host (e.g., Apache mod_dav, wsgidav, custom Python http.server with PROPFIND handler) bound to TCP/80 or TCP/443

CVE-2026-32202 is an actively exploited Windows Shell protection-mechanism-failure (CWE-693) that allows a remote unauthenticated attacker to coerce NTLM authentication when a victim merely views a folder containing a weaponized LNK shortcut. Discovered by Akamai as a residual bypass of Microsoft's February 2026 patch for CVE-2026-21510, the flaw was patched on April 14, 2026 and added to the CISA Known Exploited Vulnerabilities catalog on April 28, 2026 with an FCEB remediation deadline of May 12, 2026. The predecessor CVE-2026-21510 was previously weaponized by Russian APT28 (Fancy Bear / UAC-0001) against Ukrainian and EU government targets; whether the same actor is responsible for the current in-the-wild CVE-2026-32202 exploitation remains publicly unconfirmed.

How CVE-2026-32202 works

CVE-2026-32202 is a Windows Shell protection mechanism failure vulnerability (CWE-693) that enables remote spoofing and NTLM authentication coercion against any Windows endpoint where Explorer or any process invoking SHParseDisplayName / IShellLink::Resolve auto-parses an attacker-controlled LNK shortcut. Microsoft assigned the CVE on April 14, 2026 (April Patch Tuesday) after Akamai researchers identified that the February 2026 fix for the predecessor RCE CVE-2026-21510 left a residual code path in shell32.dll that still resolves UNC targets embedded in LNK metadata (icon path, working directory, target path) without enforcing the patched protection check. CISA added the issue to the Known Exploited Vulnerabilities (KEV) catalog on April 28, 2026 with a Federal Civilian Executive Branch remediation deadline of May 12, 2026 under Binding Operational Directive 22-01.

Exploitation chain: an attacker delivers a weaponized .lnk file via spearphishing attachment, malicious link, HTML smuggling, USB drop, or compromised file share. The LNK contains an embedded UNC path (\\attacker-host\share\icon.ico or http(s)-prefixed WebDAV URL). When Windows Explorer renders the containing folder — including via the Preview Pane, Quick Look in File Open dialogs, or background icon-cache rebuilds — the Shell automatically resolves the UNC reference. This triggers the WebClient (WebDAV) service or SMB redirector to perform an outbound NTLM challenge-response handshake to the attacker, leaking the user's NTLMv2 hash. The attacker can then crack the hash offline, or relay it in real time (e.g., Impacket ntlmrelayx) against a target service that does not enforce SMB signing or EPA, achieving lateral movement, mailbox access, ADCS certificate issuance, or domain takeover.

NVD scores the issue CVSS 3.1 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). Threadlinqs Intelligence assigns CRITICAL severity due to (1) automatic CISA KEV inclusion with active in-the-wild exploitation, (2) a federal patch mandate, (3) a documented incomplete-patch lineage with a previously weaponized RCE predecessor, and (4) the credential-relay impact chain that converts the low-impact spoofing primitive into full domain compromise.

Affected platforms: Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, 2025. Microsoft's April 2026 cumulative updates ship the corrected protection check; build floors are listed in the affected_json field.

Defenders should: (1) deploy the April 2026 Microsoft cumulative updates immediately; (2) block outbound SMB (TCP/445) and WebDAV (port 80/443 to public destinations from end-user workstations) at the perimeter and host firewall; (3) disable the WebClient service where business need is absent; (4) enforce SMB signing and Extended Protection for Authentication on all internal services; (5) deploy Defender ASR rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)" in Block mode; (6) hunt for explorer.exe → outbound 445 or unauthenticated WebDAV PROPFIND telemetry. Detection coverage from @Detector covers Splunk SPL, Microsoft Sentinel KQL, and Sigma + CQL/Cortex variants. Pentester-supplied simulation steps cover Atomic Red Team T1187 forced-authentication exercises and Impacket-based relay validation.

MITRE ATT&CK techniques used in TL-2026-0435

Credential Access

T1003.005 OS Credential Dumping: Cached Domain Credentials; T1187 Forced Authentication; T1557.001 Name Resolution Poisoning and SMB Relay

Lateral Movement

T1021.002 Remote Services: SMB/Windows Admin Shares; T1550.002 Use Alternate Authentication Material: Pass the Hash; T1570 Lateral Tool Transfer

Defense Evasion

T1027.006 Obfuscated Files or Information: HTML Smuggling; T1036.005 Match Legitimate Resource Name or Location; T1564.001 Hide Artifacts: Hidden Files and Directories

Command and Control

T1071.002 Application Layer Protocol: File Transfer Protocols; T1105 Ingress Tool Transfer

Discovery

T1083 File and Directory Discovery

Initial Access

T1091 Replication Through Removable Media; T1189 Drive-by Compromise; T1566 Phishing; T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link

Execution

T1204 User Execution; T1204.001 User Execution: Malicious Link; T1204.002 User Execution: Malicious File

Affected products and versions in CVE-2026-32202

  • Microsoft — Windows 10 1607
    Vulnerable versions: < 10.0.14393.9060
    Fixed in: 10.0.14393.9060
  • Microsoft — Windows 10 1809
    Vulnerable versions: < 10.0.17763.8644
    Fixed in: 10.0.17763.8644
  • Microsoft — Windows 10 21H2
    Vulnerable versions: < 10.0.19044.7184
    Fixed in: 10.0.19044.7184
  • Microsoft — Windows 10 22H2
    Vulnerable versions: < 10.0.19045.7184
    Fixed in: 10.0.19045.7184
  • Microsoft — Windows 11 23H2
    Vulnerable versions: < 10.0.22631.6936
    Fixed in: 10.0.22631.6936
  • Microsoft — Windows 11 24H2
    Vulnerable versions: < 10.0.26100.8246
    Fixed in: 10.0.26100.8246
  • Microsoft — Windows 11 25H2
    Vulnerable versions: < 10.0.26200.8246
    Fixed in: 10.0.26200.8246
  • Microsoft — Windows 11 26H1
    Vulnerable versions: < 10.0.28000.1836
    Fixed in: 10.0.28000.1836
  • Microsoft — Windows Server 2012
    Vulnerable versions: RTM
    Fixed in: April 2026 monthly rollup (ESU)
  • Microsoft — Windows Server 2012 R2
    Vulnerable versions: all
    Fixed in: April 2026 monthly rollup (ESU)

Remediation for CVE-2026-32202

Patches

  • Windows 10 1607 / Server 2016: build 10.0.14393.9060 or later (April 2026 cumulative).
  • Windows 10 1809 / Server 2019: build 10.0.17763.8644 or later.
  • Windows 10 21H2: build 10.0.19044.7184 or later.
  • Windows 10 22H2: build 10.0.19045.7184 or later.
  • Windows 11 23H2: build 10.0.22631.6936 or later.
  • Windows 11 24H2: build 10.0.26100.8246 or later.
  • Windows 11 25H2: build 10.0.26200.8246 or later.
  • Windows 11 26H1: build 10.0.28000.1836 or later.
  • Windows Server 2022: build 10.0.20348.5020 or later.
  • Windows Server 2022 23H2: build 10.0.25398.2274 or later.

Immediate actions

  • Apply the April 2026 Microsoft cumulative update for the affected SKU (build floors in affected_json).
  • Block outbound TCP/445 (SMB) from end-user subnets to all non-RFC1918 destinations at perimeter and host firewall.
  • Block outbound TCP/80 and TCP/443 WebDAV PROPFIND/OPTIONS from end-user workstations to non-allowlisted destinations.
  • Disable the WebClient (WebDAV mini-redirector) service on workstations and servers where there is no documented business requirement.
  • Enable Microsoft Defender ASR rules: Block credential stealing from LSASS, Block all Office applications from creating child processes, Block executable content from email client and webmail.

Workarounds

  • Set Group Policy 'Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers' to 'Deny all' (test for application breakage first).
  • Disable preview pane and details pane in Windows Explorer via GPO to reduce auto-parse exposure.
  • Block file extensions .lnk, .url, .scf, .library-ms at the email gateway and at the SMB share level for user-uploaded content.
  • Set HKLM\SYSTEM\CurrentControlSet\Services\WebClient\Parameters\BasicAuthLevel = 0 and WebDAV BasicAuthLevel registry to suppress WebDAV authentication.

Longer-term hardening

  • Enforce SMB signing (required) on all servers and workstations via Group Policy.
  • Enable Extended Protection for Authentication (EPA) on AD CS, Exchange, LDAP-S, and IIS endpoints to defeat NTLM relay.
  • Migrate from NTLM to Kerberos-only authentication where feasible; audit and remove NTLM dependencies.
  • Deploy LDAP channel binding and signing enforcement (RFC 2829) on all domain controllers.
  • Roll out Credential Guard and Remote Credential Guard on all eligible endpoints.
  • Segment user workstations from server VLANs; require jump-host access for administrative SMB.
  • Deploy EDR with behavioral detection for explorer.exe initiating outbound NTLM authentication.

CVEs associated with CVE-2026-32202

CVE-2026-32202, CVE-2026-21510, CVE-2026-21513

Weaknesses (CWE) in CVE-2026-32202

CWE-693, CWE-294, CWE-522

Timeline of CVE-2026-32202

  • Microsoft publishes CVE-2026-21510 (Windows Shell RCE, CVSS 8.8). CISA adds it to the KEV catalog the same day with a 2026-03-03 FCEB remediation deadline.
  • Reports surface that Russian APT28 (Fancy Bear / UAC-0001) is exploiting CVE-2026-21510 against Ukrainian and EU government targets via spearphishing-delivered LNK attachments.
  • Akamai security researchers begin systematic analysis of the February 2026 CVE-2026-21510 patch and identify a residual code path in shell32.dll that still resolves UNC-prefixed LNK metadata without enforcing the corrected protection check.
  • Akamai privately discloses the patch bypass to Microsoft Security Response Center under coordinated vulnerability disclosure.
  • Microsoft assigns CVE-2026-32202 and ships fixes in the April 2026 cumulative updates across Windows 10, Windows 11, and Windows Server 2012 through 2025. NVD initial scoring: CVSS 4.3 MEDIUM (CWE-693, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).
  • Microsoft Threat Intelligence reports first in-the-wild exploitation of CVE-2026-32202 against unpatched endpoints. Attribution remains undisclosed at time of publication.
  • CISA adds CVE-2026-32202 to the Known Exploited Vulnerabilities catalog under 'Microsoft Windows Protection Mechanism Failure Vulnerability' and sets FCEB remediation deadline to 2026-05-12 under BOD 22-01.
  • BleepingComputer publishes coverage detailing CISA's directive and the Akamai-discovered patch-bypass lineage. Security teams across federal civilian agencies, financial services, and critical infrastructure begin emergency patch cycles.
  • Federal Civilian Executive Branch agencies must complete remediation of CVE-2026-32202 in production environments under CISA Binding Operational Directive 22-01.
  • As of 2026-05-29, CVE-2026-32202 remains a live concern: Microsoft (advisory corrected Apr 27) and CISA KEV (added Apr 28, FCEB deadline May 12) confirm in-the-wild zero-click NTLM-coercion exploitation, attributed by Akamai/reporting to Russia's APT28. A patch shipped Apr 14 2026 but no successor fix supersedes it, the actor is undisrupted, and unpatched endpoints stay exploitable.

Sources cited for CVE-2026-32202

Threats related to CVE-2026-32202

Detection coverage for TL-2026-0435

As of 2026-04-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0435 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats