{"id":731,"date":"2026-04-28T08:50:24","date_gmt":"2026-04-28T08:50:24","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=731"},"modified":"2026-04-28T08:50:24","modified_gmt":"2026-04-28T08:50:24","slug":"microsoft-confirms-active-exploitation-of-windows-shell-cve-2026-32202","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=731","title":{"rendered":"Microsoft Confirms Active Exploitation of Windows Shell CVE-2026-32202"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Apr 28, 2026<\/span><\/span>Vulnerability \/ Threat Intelligence<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Microsoft on Monday revised its advisory for a now-patched, high-severity security flaw impacting Windows Shell to acknowledge that it has been actively exploited in the wild.<\/p>\n

The vulnerability in question is CVE-2026-32202<\/strong> (CVSS score: 4.3), a spoofing vulnerability that could allow an attacker to access sensitive information. It was addressed as part of its Patch Tuesday update for this month.<\/p>\n

\u00abProtection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network,\u00bb Microsoft noted<\/a> in an alert. \u00abAn attacker would have to send the victim a malicious file that the victim would have to execute.\u00bb<\/p>\n

\u00abAn attacker who successfully exploited the vulnerability could view some sensitive information (Confidentiality) but not all resources within the impacted component may be divulged to the attacker. The attacker cannot make changes to disclosed information (Integrity) or limit access to the resource (Availability).\u00bb<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

On April 27, 2026, Microsoft said it rectified the \u00abExploitability Index, Exploited flag, and CVSS vector\u00bb as they were incorrect when they were published on April 14.<\/p>\n

While the tech giant did not share any details about the exploitation activity, Akamai security researcher Maor Dahan, who is credited with discovering and reporting the bug, said the zero-click vulnerability stems from an incomplete patch for CVE-2026-21510.<\/p>\n

The latter has been weaponized by a Russian nation-state group tracked as APT28 (aka Fancy Bear, Forest Blizzard, GruesomeLarch, and Pawn Storm) along with CVE-2026-21513 as part of an exploit chain –<\/p>\n

<\/p>\n