CVE-2026-32202

Actively exploited

CISA lists CVE-2026-32202 in its Known Exploited Vulnerabilities catalog, which means exploitation has been observed. The entry applies to Microsoft Windows.

• Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Public exploit: Cataloged public exploit.

• Microsoft Security Response Center: Exploitation reported by Microsoft Security Response Center (2026-08-21)

  Microsoft exploitation status: Exploited:Yes

• Exploit-DB: Microsoft - NTLMv2 Hash Capture (2026-09-23 21:40:27.335989+00)

  Exploit-DB lists a public exploit or proof of concept for this CVE. SecurityAlert has not executed it; this is not evidence of attacks against your systems.