CVE-2026-32202

Microsoft Windows Protection Mechanism Failure Vulnerability

Microsoft Windows CWE-693

Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.

CVSS Score

4.3

Medium

EPSS — Exploit Probability

64%

Riskier than 99% of all CVEs

Exploitation

Confirmed in the wild

Used in ransomware campaigns

Remediation

Patch available

Federal deadline 2026-05-12

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2026-05-12.

NVD entry Vendor patch PoC / advisory CISA KEV

6 articles across 5 outlets · first covered Apr 27, 2026 · latest Apr 29, 2026

Tracked incidents

vulnerability closed 4 articles

CISA adds Windows Shell and ConnectWise ScreenConnect flaws to Known Exploited Vulnerabilities catalog

Associated threat actors

APT28

Coverage timeline

CISA Flags Actively Exploited CVE-2024-1708 and Windows Flaw
thehackernews.com · Apr 29, 2026
CISA Adds ConnectWise ScreenConnect Path Flaw and Windows Shell Bug
securityaffairs.com · Apr 29, 2026
Microsoft Windows Shell flaw allows network spoofing; patch urged
www.cisa.gov · Apr 28, 2026
CISA Warns of Active Windows Shell Spoof Flaw CVE-2026-32202
cisa.gov · Apr 28, 2026
Microsoft Warns of Active Exploit in CVE-2026-32202 Spoof Flaw
thehackernews.com · Apr 28, 2026
APT28 exploits Windows SmartScreen gap for zero click LNK attacks
www.securityweek.com · Apr 27, 2026

Related CVEs — Microsoft

CVE-2026-45659KEV CVE-2026-33825KEV CVE-2026-42897KEV CVE-2026-41091KEV CVE-2008-4250KEV CVE-2009-1537KEV CVE-2010-0249KEV CVE-2010-0806KEV