CVE-2026-32202
Microsoft Windows Protection Mechanism Failure Vulnerability
Description
CVE-2026-32202 is a MEDIUM severity protection mechanism failure in Microsoft Windows Shell with a CVSS 3.1 score of 4.3. The flaw allows an unauthorized remote attacker to perform spoofing over a network — for example, by tricking Windows Shell into mis-rendering a security indicator or trust boundary on a crafted item delivered to a user. Exploitation requires user interaction (typically opening or previewing a malicious file), but no authentication. CISA added CVE-2026-32202 to the KEV catalog on April 28, 2026, with a remediation deadline of May 12, 2026, after observing in-the-wild use against Windows endpoints. While the EPSS score of 0.0009 (26th percentile) is low, KEV inclusion confirms that targeted operators are actively chaining this Windows Shell spoofing weakness into broader social-engineering or initial-access flows.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1607 | < 10.0.14393.9060 |
| microsoft | windows 10 1809 | < 10.0.17763.8644 |
| microsoft | windows 10 21h2 | < 10.0.19044.7184 |
| microsoft | windows 10 22h2 | < 10.0.19045.7184 |
| microsoft | windows 11 23h2 | < 10.0.22631.6936 |
| microsoft | windows 11 24h2 | < 10.0.26100.8246 |
| microsoft | windows 11 25h2 | < 10.0.26200.8246 |
| microsoft | windows 11 26h1 | < 10.0.28000.1836 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.9060 |
| microsoft | windows server 2019 | < 10.0.17763.8644 |
| microsoft | windows server 2022 | < 10.0.20348.5020 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.2274 |
| microsoft | windows server 2025 | < 10.0.26100.32690 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32202(Vendor Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2026-32202-detection-script-spoofing-vulnerability-in-windows-shell(Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2026-32202-mitigation-script-spoofing-vulnerability-in-windows-shell(Mitigation, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-32202(Third Party Advisory, US Government Resource)
Weakness Type
CWE-693: Protection Mechanism Failure
Protection Mechanism Failure occurs when a product does not use, or incorrectly uses, a protection mechanism that provides sufficient defense against directed attacks. In CVE-2026-32202, Windows Shell — the component responsible for rendering the desktop, file previews, and trust indicators such as Mark-of-the-Web (MOTW) and SmartScreen prompts — fails to enforce or correctly evaluate one of these protections, allowing a crafted item to appear more trustworthy than it is. The result is a network-delivered spoofing condition: the attacker controls the visible representation of a file or shell artifact in a way that misleads the user into trusting attacker-controlled content.
Learn more: CWE-693 — Protection Mechanism Failure
Impact Analysis
CVE-2026-32202 carries a CVSS 3.1 score of 4.3 (MEDIUM) with the vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N — exploitable over the network with low complexity, no privileges required, but with required user interaction and only Low impact on confidentiality (no integrity or availability impact). On its own, the vulnerability is a spoofing primitive rather than a code-execution vulnerability: the attacker cannot directly run code or modify data, but can manipulate what the user sees in Windows Shell to convince them that a malicious file, link, or shell item is legitimate. In practice this is a stepping-stone weakness, typically chained with a separate execution vulnerability or a malware payload that the user is then more likely to launch because Windows Shell mis-represents its origin or trust state. The KEV listing demonstrates that active operators have integrated CVE-2026-32202 into real intrusion chains, so even though the standalone CVSS rating is moderate, defenders should not deprioritize it as a "spoofing only" issue.
Exploit Maturity
Active Exploitation: CISA confirmed in-the-wild exploitation of CVE-2026-32202 by adding it to the Known Exploited Vulnerabilities catalog on April 28, 2026. Public Exploits: No public proof-of-concept code is currently catalogued in the NVD references, and no "Exploit" tag is present on the listed advisories — see Microsoft's MSRC entry for the official advisory. The lack of public PoC suggests that exploitation observed by CISA was likely the work of an experienced operator who developed a private chain rather than mass commodity malware. Exploitation Probability: With an EPSS score of 0.0009 (0.09%, 26th percentile), the model rates the short-term probability of broad exploitation as low, which is typical for spoofing primitives that require user interaction and tailored social-engineering. Chaining potential: Spoofing in Windows Shell is most dangerous when combined with file-format vulnerabilities, MOTW bypasses, or LNK/Internet-Shortcut abuse — defenders should assume CVE-2026-32202 is being used as part of a multi-stage initial-access flow rather than as a standalone exploit.
Remediation
- Apply Microsoft's April 2026 cumulative updates immediately. The fixed builds are listed in the affected products: Windows 10 1607/Server 2016 ≥ 10.0.14393.9060, Windows 10 1809/Server 2019 ≥ 10.0.17763.8644, Windows 10 21H2/22H2 ≥ 10.0.19044/19045.7184, Windows 11 23H2 ≥ 10.0.22631.6936, Windows 11 24H2/25H2 ≥ 10.0.26100/26200.8246, Windows 11 26H1 ≥ 10.0.28000.1836, Windows Server 2022 ≥ 10.0.20348.5020, Server 2022 23H2 ≥ 10.0.25398.2274, Server 2025 ≥ 10.0.26100.32690.
- Prioritize internet-facing and user-facing endpoints. Workstations used for email, web browsing, and file handling are the primary target surface for a spoofing vulnerability. Patch user fleets and high-risk roles (executives, finance, IT admins) before rolling to back-end servers.
- Reinforce Mark-of-the-Web and SmartScreen controls. Ensure Microsoft Defender SmartScreen is enabled and that Office Protected View, MOTW, and ASR rules that block executable content from email and webmail clients remain in place — these mitigate the social-engineering chains that typically follow a Shell spoofing trigger.
- Detection: hunt for unusual shell-rendered artifacts. Look for newly delivered LNK files, Internet Shortcuts (.url), and archive-extracted payloads that lack expected MOTW metadata or trigger SmartScreen alerts. Correlate with email gateway logs to identify originating campaigns.
- User awareness. Brief users that an up-to-date Windows shell trust indicator is not a guarantee on unpatched systems and reinforce the existing rules around opening attachments and links from untrusted sources, particularly until April 2026 cumulative updates are deployed across the estate.
Technical Details
CVE-2026-32202 is a CWE-693 protection mechanism failure in the Windows Shell trust-indicator and presentation pipeline. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N tells us the issue is reachable over the network, has low attack complexity, requires no authentication, and depends on the user interacting with a crafted item — for example opening a file delivered by email or web download. The impact is limited to a Low confidentiality effect with Scope:Unchanged: the spoofing primitive lets an attacker control the visual or semantic representation of a shell artifact, leaking trust to attacker-controlled content rather than directly disclosing data. Microsoft's affected-products list spans the entire supported Windows 10 and Windows 11 line as well as Windows Server 2012 R2 through 2025, indicating the defective protection check sits in shared Shell code that has been carried across release branches. Because this class of bug typically interacts with MOTW, file-association handling, or zone-of-origin enforcement, the practical attacker workflow is to package a malicious file or shortcut in a way that Windows Shell renders as a legitimate, low-risk item — so detection should focus on shell artifacts that appear trusted but originated from a network source.
Frequently Asked Questions
Is CVE-2026-32202 being actively exploited?
Yes — CISA added CVE-2026-32202 to the KEV catalog on April 28, 2026, indicating confirmed in-the-wild exploitation, even though the EPSS score of 0.09% suggests targeted rather than mass campaigns. There is no public proof-of-concept exploit code at this time, but defenders should patch within the May 12, 2026 deadline.
What products are affected by CVE-2026-32202?
CVE-2026-32202 affects all currently supported Windows client and server SKUs: Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2012/2012 R2, 2016, 2019, 2022, 2022 23H2, and 2025. Specific fixed builds are documented in the Microsoft April 2026 advisory.
How do I fix CVE-2026-32202?
Install the April 2026 Windows cumulative update for your specific Windows build, prioritize user-facing endpoints, and verify that Microsoft Defender SmartScreen, Mark-of-the-Web, and ASR rules are enabled to mitigate downstream stages of the typical attack chain.
How severe is CVE-2026-32202?
CVE-2026-32202 is rated MEDIUM (CVSS 3.1 score 4.3) — only Low confidentiality impact and no integrity or availability impact. However, KEV inclusion shows real attackers consider it useful enough to integrate into intrusion chains, so the operational severity is higher than the score alone suggests.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.