Overview
What is CVE-2026-32202?
Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.
CVE intelligenceCISA KEV
CVE-2026-32202
Microsoft Windows Protection Mechanism Failure Vulnerability
4.3MEDIUMCVSS out of 10
What this means
Actively exploited
CISA lists CVE-2026-32202 in its Known Exploited Vulnerabilities catalog, which means exploitation has been observed. The entry applies to Microsoft Windows.
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Public exploit: Cataloged public exploit. Review the linked vendor advisory and apply the mitigation or fixed release for your affected product.
- Microsoft Security Response Center: Exploitation reported by Microsoft Security Response Center (2026-08-21)
- Exploit-DB: Microsoft - NTLMv2 Hash Capture (2026-09-23 21:40:27.335989+00)
CISA KEVListedObserved exploitation
EPSS4.9%Estimated 30-day exploitation probability
Ransomware useNot markedCISA KEV ransomware field
Threat actors0Source-linked actor relationships