CVE-2026-32202

Name of the Vulnerable Software and Affected Versions Microsoft Windows (affected versions not specified)

Description A protection mechanism failure in the Windows Shell allows a remote unauthorized attacker to perform spoofing. The issue occurs when a malicious Windows shortcut or LNK path triggers an automatic SMB authentication attempt, which exposes the victim's Net-NTLMv2 hash for potential relay or offline cracking. This can happen without user interaction, such as when a user simply opens a folder containing a malicious shortcut. This flaw has been actively exploited in the wild by APT28 (Fancy Bear) targeting Ukraine and EU nations as part of a zero-click credential theft chain.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.