CVE-2026-32202 — Windows Shell Protection Mechanism Failure: NTLM Authentication Coercion via Auto-Parsed LNK Files (CISA KEV) — Threadlinqs Intelligence
As of 2026-05-30, CVE-2026-32202 — Windows Shell Protection Mechanism Failure: NTLM Authentication Coercion via Auto-Parsed LNK Files (CISA KEV) is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 16 indicators of compromise.
Threat ID: TL-2026-0435 · Severity: CRITICAL · CVSS: 4.3 · Status: ACTIVE · Category: VULNERABILITY
CVE-2026-32202 is an actively exploited Windows Shell protection-mechanism-failure (CWE-693) that allows a remote unauthenticated attacker to coerce NTLM authentication when a victim merely views a
CVE-2026-32202 is a Windows Shell protection mechanism failure vulnerability (CWE-693) that enables remote spoofing and NTLM authentication coercion against any Windows endpoint where Explorer or any process invoking SHParseDisplayName / IShellLink::Resolve auto-parses an attacker-controlled LNK shortcut. Microsoft assigned the CVE on April 14, 2026 (April Patch Tuesday) after Akamai researchers identified that the February 2026 fix for the predecessor RCE CVE-2026-21510 left a residual code path in shell32.dll that still resolves UNC targets embedded in LNK metadata (icon path, working directory, target path) without enforcing the patched protection check. CISA added the issue to the Known Exploited Vulnerabilities (KEV) catalog on April 28, 2026 with a Federal Civilian Executive Branch remediation deadline of May 12, 2026 under Binding Operational Directive 22-01.
Exploitation chain: an attacker delivers a weaponized .lnk file via spearphishing attachment, malicious link, HTML smuggling, USB drop, or compromised file share. The LNK contains an embedded UNC path (\\attacker-host\share\icon.ico or http(s)-prefixed WebDAV URL). When Windows Explorer renders the containing folder — including via the Preview Pane, Quick Look in File Open dialogs, or background icon-cache rebuilds — the Shell automatically resolves the UNC reference. This triggers the WebClient (WebDAV) service or SMB redirector to perform an outbound NTLM challenge-response handshake to the attacker, leaking the user's NTLMv2 hash. The attacker can then crack the hash offline, or relay it in real time (e.g., Impacket ntlmrelayx) against a target service that does not enforce SMB signing or EPA, achieving lateral movement, mailbox access, ADCS certificate issuance, or domain takeover.
NVD scores the issue CVSS 3.1 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). Threadlinqs Intelligence assigns CRITICAL severity due to (1) automatic CISA KEV inclusion with active in-the-wild exploitation, (2) a federal patch mandate, (3) a documented incomplete-patch lineage with a previously weaponized RCE predecessor, and (4) the credential-relay impact chain that converts the low-impact spoofing primitive into full domain compromise.
Affected platforms: Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, 2025. Microsoft's April 2026 cumulative updates ship the corrected protection check; build floors are listed in the affected_json field.
Defenders should: (1) deploy the April 2026 Microsoft cumulative updates immediately; (2) block outbound SMB (TCP/445) and WebDAV (port 80/443 to public destinations from end-user workstations) at the perimeter and host firewall; (3) disable the WebClient service where business need is absent; (4) enforce SMB signing and Extended Protection for Authentication on all internal services; (5) deploy Defender ASR rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)" in Block mode; (6) hunt for explorer.exe → outbound 445 or unauthenticated WebDAV PROPFIND telemetry. Detection coverage from @Detector covers Splunk SPL, Microsoft Sentinel KQL, and Sigma + CQL/Cortex variants. Pentester-supplied simulation steps cover Atomic Red Team T1187 forced-authentication exercises and Impacket-based relay validation.
Weaknesses (CWE)
CWE-693, CWE-294, CWE-522
Target sectors: government, federal-civilian, defense, financial, energy, healthcare, critical-infrastructure, education, technology
Target regions: North America, Europe, Ukraine, European Union
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 16 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-32202, CVE-2026-21510, CVE-2026-21513, T1566, T1566.001, T1566.002, T1091, T1189, T1204, T1204.001, T1204.002, T1036.005, T1564.001