# CVE-2026-32202 — Windows Shell Protection Mechanism Failure: NTLM Authentication Coercion via Auto-Parsed LNK Files (CISA KEV)

> CVE-2026-32202 is an actively exploited Windows Shell protection-mechanism-failure (CWE-693) that allows a remote unauthenticated attacker to coerce NTLM authentication when a victim merely views a folder containing a weaponized LNK shortcut. Discovered by Akamai as a residual bypass of Microsoft's February 2026 patch for CVE-2026-21510, the flaw was patched on April 14, 2026 and added to the CISA Known Exploited Vulnerabilities catalog on April 28, 2026 with an FCEB remediation deadline of May 12, 2026. The predecessor CVE-2026-21510 was previously weaponized by Russian APT28 (Fancy Bear / UAC-0001) against Ukrainian and EU government targets; whether the same actor is responsible for the current in-the-wild CVE-2026-32202 exploitation remains publicly unconfirmed.

- **Published:** 2026-04-29T12:11:14Z
- **Last reviewed:** 2026-04-29T12:11:14Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0435
- **ID:** TL-2026-0435
- **Severity:** CRITICAL (CVSS 4.3)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-32202, CVE-2026-21510, CVE-2026-21513

## Description

CVE-2026-32202 is a Windows Shell protection mechanism failure vulnerability (CWE-693) that enables remote spoofing and NTLM authentication coercion against any Windows endpoint where Explorer or any process invoking SHParseDisplayName / IShellLink::Resolve auto-parses an attacker-controlled LNK shortcut. Microsoft assigned the CVE on April 14, 2026 (April Patch Tuesday) after Akamai researchers identified that the February 2026 fix for the predecessor RCE CVE-2026-21510 left a residual code path in shell32.dll that still resolves UNC targets embedded in LNK metadata (icon path, working directory, target path) without enforcing the patched protection check. CISA added the issue to the Known Exploited Vulnerabilities (KEV) catalog on April 28, 2026 with a Federal Civilian Executive Branch remediation deadline of May 12, 2026 under Binding Operational Directive 22-01.

Exploitation chain: an attacker delivers a weaponized .lnk file via spearphishing attachment, malicious link, HTML smuggling, USB drop, or compromised file share. The LNK contains an embedded UNC path (\\attacker-host\share\icon.ico or http(s)-prefixed WebDAV URL). When Windows Explorer renders the containing folder — including via the Preview Pane, Quick Look in File Open dialogs, or background icon-cache rebuilds — the Shell automatically resolves the UNC reference. This triggers the WebClient (WebDAV) service or SMB redirector to perform an outbound NTLM challenge-response handshake to the attacker, leaking the user's NTLMv2 hash. The attacker can then crack the hash offline, or relay it in real time (e.g., Impacket ntlmrelayx) against a target service that does not enforce SMB signing or EPA, achieving lateral movement, mailbox access, ADCS certificate issuance, or domain takeover.

NVD scores the issue CVSS 3.1 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). Threadlinqs Intelligence assigns CRITICAL severity due to (1) automatic CISA KEV inclusion with active in-the-wild exploitation, (2) a federal patch mandate, (3) a documented incomplete-patch lineage with a previously weaponized RCE predecessor, and (4) the credential-relay impact chain that converts the low-impact spoofing primitive into full domain compromise.

Affected platforms: Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, 2025. Microsoft's April 2026 cumulative updates ship the corrected protection check; build floors are listed in the affected_json field.

Defenders should: (1) deploy the April 2026 Microsoft cumulative updates immediately; (2) block outbound SMB (TCP/445) and WebDAV (port 80/443 to public destinations from end-user workstations) at the perimeter and host firewall; (3) disable the WebClient service where business need is absent; (4) enforce SMB signing and Extended Protection for Authentication on all internal services; (5) deploy Defender ASR rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)" in Block mode; (6) hunt for explorer.exe → outbound 445 or unauthenticated WebDAV PROPFIND telemetry. Detection coverage from @Detector covers Splunk SPL, Microsoft Sentinel KQL, and Sigma + CQL/Cortex variants. Pentester-supplied simulation steps cover Atomic Red Team T1187 forced-authentication exercises and Impacket-based relay validation.

## MITRE ATT&CK

- T1566 Phishing
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1091 Replication Through Removable Media
- T1189 Drive-by Compromise
- T1204 User Execution
- T1204.001 User Execution: Malicious Link
- T1204.002 User Execution: Malicious File
- T1036.005 Match Legitimate Resource Name or Location
- T1564.001 Hide Artifacts: Hidden Files and Directories
- T1027.006 Obfuscated Files or Information: HTML Smuggling
- T1187 Forced Authentication
- T1557.001 Name Resolution Poisoning and SMB Relay
- T1003.005 OS Credential Dumping: Cached Domain Credentials
- T1083 File and Directory Discovery
- T1550.002 Use Alternate Authentication Material: Pass the Hash
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1570 Lateral Tool Transfer
- T1071.002 Application Layer Protocol: File Transfer Protocols
- T1105 Ingress Tool Transfer

## Sources

- [Microsoft Security Response Center — CVE-2026-32202](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32202)
- [NVD — CVE-2026-32202](https://nvd.nist.gov/vuln/detail/CVE-2026-32202)
- [CISA Known Exploited Vulnerabilities Catalog — CVE-2026-32202](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-32202)
- [CISA Binding Operational Directive 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities)
- [BleepingComputer — CISA orders feds to patch Windows flaw exploited as zero-day](https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-windows-flaw-exploited-in-zero-day-attacks/)
- [Microsoft Security Response Center — CVE-2026-21510 (predecessor RCE)](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21510)
- [NVD — CVE-2026-21510 (predecessor)](https://nvd.nist.gov/vuln/detail/CVE-2026-21510)
- [NVD — CVE-2026-21513 (related MSHTML protection bypass)](https://nvd.nist.gov/vuln/detail/CVE-2026-21513)
- [MITRE ATT&CK — T1187 Forced Authentication](https://attack.mitre.org/techniques/T1187/)
- [MITRE ATT&CK — T1557.001 LLMNR/NBT-NS Poisoning and SMB Relay](https://attack.mitre.org/techniques/T1557/001/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0435