What happened? - Another Windows Shell vulnerability after an inadequate patch
Microsoft is once again facing a critical security hole in the Windows Shell. After the cyber gang APT28, known as Fancy Bear, had already exploited vulnerability CVE-2026-21510 in the wild, Microsoft's February patch proved inadequate. The deficient software fix left behind a new vulnerability, CVE-2026-32202, which is now also under active attack.
Microsoft rated the new vulnerability with a CVSS score of 4.3 ("medium" risk) and fixed it on April's Patch Tuesday. During Monday, however, the developers updated the vulnerability entry with a worrying message: the spoofing flaw in the Windows Shell is now being abused by malicious actors in the wild.
The details - Zero-click exploit enables automatic NTLM authentication
While Microsoft rates the impact of the new vulnerability as less serious than the original flaw, an analysis by Akamai paints a more worrying picture. The IT security experts classify CVE-2026-32202 as a zero-click vulnerability - contrary to Microsoft's assessment that victims have to execute a malicious file.
The problem lies in an overlooked code path: when displaying directories, Windows Explorer automatically attempts to extract icons for the target files from LNK files. In doing so, a path check takes place that can establish a connection to external SMB servers - without any further user interaction.
The attack mechanism in detail
The attack works as follows: an LNK file contains a link to a remote server, for example "\\attacker.com\share\payload.cpl". As soon as the victim opens the relevant directory, the computer automatically establishes a connection to the SMB server and starts an NTLM authentication. In the process, the victim machine's Net-NTLMv2 hash is transmitted to the attackers.
These hash values can then be abused for NTLM relay attacks and offline cracking, opening up far-reaching options for follow-up attacks.
Assessment - Why this vulnerability is particularly dangerous
The danger of this vulnerability lies in its apparent harmlessness. Whereas the original flaw CVE-2026-21510 allowed malicious code to be executed from the network, the new vulnerability appears less threatening at first glance. Microsoft describes it as a spoofing flaw with medium risk.
In reality, however, it gives attackers zero-click access to sensitive authentication data. In corporate environments, where security systems such as access control and video surveillance are often managed over the network, compromised NTLM hashes can open the door to critical security infrastructure.
The fact that APT28/Fancy Bear - a state-sponsored hacking group - is already exploiting both vulnerabilities underlines the strategic importance of these attack vectors for professional cybercriminals.
Practical tips - Immediate measures for IT managers
IT administrators should take the following measures without delay:
- Install the patch immediately: Microsoft's April update must be installed on all Windows systems without delay
- Network monitoring: Monitor SMB connections to external servers, especially unexpected authentication attempts
- Email security: Step up filtering of email attachments, particularly LNK files
- NTLM hardening: Review and tighten the NTLM configuration in Active Directory
Operators of critical infrastructure such as security systems should be particularly vigilant. Deposit safes, offertory boxes and modern access control systems are often network-based and could become vulnerable via compromised administrator accounts.
Outlook - Lessons learned and future developments
The case is a prime example of the challenges involved in patching complex software systems. An incomplete patch can create new attack vectors that experienced attackers quickly identify and exploit.
For the security industry, this reinforces the trend towards zero-trust architectures. Traditional perimeter-based security concepts reach their limits when attackers already have legitimate authentication credentials at their disposal.
Microsoft has announced that it will fundamentally overhaul authentication in Active Directory. In the medium term, this could lead to a move away from the outdated NTLM concepts that have been regarded as a security risk for years.
Companies should take these developments as an opportunity to rethink their entire security strategy. Modern solutions such as WardHub for the central management of security systems can help to protect critical areas even when the network infrastructure has been compromised.
The threat situation will continue to intensify, as state-sponsored groups such as APT28 continuously develop new attack vectors. Proactive security measures and prompt patch cycles are therefore becoming a business-critical necessity.
