CISA Adds Actively Exploited Windows Flaw (CVE-2026-32202) to KEV Catalog

Executive Summary

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-32202, a privilege escalation vulnerability in Microsoft Windows, to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation. This vulnerability is particularly notable as it stems from an incomplete patch for a previous zero-day, CVE-2026-21510. The original flaw was exploited by the Russian state-sponsored group APT28 (Fancy Bear) in campaigns targeting entities in Ukraine and the European Union. The new flaw, CVE-2026-32202, is an authentication coercion vulnerability that can be exploited without user interaction (zero-click) to steal credentials. Federal agencies are now required to apply the patch released by Microsoft in April 2026.

Vulnerability Details

• CVE-2026-32202: An authentication coercion vulnerability in Microsoft Windows.
• Attack Vector: An attacker can exploit this vulnerability by convincing a user to open a malicious HTML file or, more critically, by placing a malicious shortcut (.lnk) file in a location that the victim's machine will automatically parse. This can trigger an authentication attempt to an attacker-controlled server, allowing the theft of NTLM hashes.
• Root Cause: The vulnerability exists because the patch for CVE-2026-21510 was incomplete. CVE-2026-21510 was a remote code execution (RCE) vulnerability exploited in the wild by APT28. The incomplete fix left open a new attack surface for credential theft.
• Zero-Click Scenario: The 'zero-click' aspect is significant. If an attacker can place a malicious .lnk file on a network share that a user browses with File Explorer, the preview pane's attempt to render the file's icon can be enough to trigger the authentication attempt to the attacker's server, without the user ever clicking on the file.

Affected Systems

• All supported versions of Microsoft Windows were affected prior to the April 2026 security updates.

Exploitation Status

CISA has confirmed that CVE-2026-32202 is being actively exploited in the wild. The original vulnerability, CVE-2026-21510, was used as a zero-day by APT28 since at least December 2025 in conjunction with CVE-2026-21513 (an MSHTML security feature bypass).

Impact Assessment

• Credential Theft: The primary impact is the theft of user NTLM hashes. These hashes can be cracked offline to reveal the user's password or used in NTLM relay attacks to authenticate to other services on the network as the victim user.
• Privilege Escalation & Lateral Movement: Once an attacker has valid credentials, they can move laterally through the network, escalate privileges, and gain access to more sensitive systems and data.
• Downstream Attacks: Stolen credentials are a key enabler for more severe attacks, including ransomware deployment and data exfiltration.

Cyber Observables — Hunting Hints

The following patterns may help identify exploitation attempts:

Detection Methods

• Network Intrusion Detection: Use an IDS/IPS to monitor for and block outbound SMB traffic to the internet. This is a critical control. D3FEND's Outbound Traffic Filtering (D3-OTF) is directly applicable.
• Endpoint Detection: EDR solutions can be configured to alert on processes like explorer.exe or rundll32.exe making outbound SMB connections, which is highly anomalous behavior.
• Vulnerability Scanning: Use a vulnerability scanner to identify all systems that are missing the April 2026 Microsoft security update.

Remediation Steps

• Patch Immediately: The primary remediation is to apply the security update for CVE-2026-32202 released by Microsoft in April 2026. Given its KEV status, this should be treated as an emergency change.
• Block Outbound SMB: As a critical compensating control, configure perimeter firewalls to block all outbound TCP port 445 traffic from your network to the internet. There are very few legitimate reasons for this traffic, and blocking it mitigates this and many other credential theft vulnerabilities.
• Disable NTLM: Where possible, organizations should move towards using Kerberos authentication and disable NTLM to prevent hash relay and cracking attacks. This is a longer-term strategic mitigation.