What is the CVSS score of CVE-2026-32202?

CVE-2026-32202 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-32202?

Yes, a public proof-of-concept exploit is available for CVE-2026-32202. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-32202?

Yes, a patch is available for CVE-2026-32202. Update the affected software to the latest version immediately.

Microsoft CVE-2026-32202

EUVD-2026-22589 MEDIUM

Protection Mechanism Failure (CWE-693)

2026-04-14 microsoft

GHSA-x62h-w968-3v9v

Authentication Bypass Microsoft

4.3

CVSS 3.1 · NVD

Temporal: 3.8

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

CIRCL (temporal)

3.8 LOW

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Added to CISA KEV

Apr 28, 2026 - 21:47 cisa

CISA KEV

PoC Detected

Apr 28, 2026 - 21:47 vuln.today

Public exploit code

Added to CISA KEV

Apr 28, 2026 - 17:32 CISA

Analysis Generated

Apr 14, 2026 - 19:41 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:46 euvd

EUVD-2026-22589

Analysis Generated

Apr 14, 2026 - 17:46 vuln.today

Patch released

Apr 14, 2026 - 17:46 nvd

Patch available

CVE Published

Apr 14, 2026 - 16:57 nvd

MEDIUM 4.3

DescriptionCVE.org

Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.

Articles & Coverage 1

POC CVE-2026-32202 PoC: NTLMv2 Hash Coercion via Malicious LNK Files Apr 30, 2026

AnalysisAI

Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a network without authentication, requiring only user interaction. This low-severity vulnerability affects multiple Windows versions from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. While not actively exploited in the wild, vendor patches are available across all affected versions, and the low CVSS score (4.3) reflects limited confidentiality impact and no availability impact despite the network-accessible attack vector.

Technical ContextAI

The vulnerability resides in Windows Shell's protection mechanisms, specifically a failure in how the shell validates or enforces security boundaries (CWE-693: Protection Mechanism Failure). Windows Shell is the core user interface component responsible for file browsing, application launching, and user-system interactions. The spoofing capability suggests an attacker can impersonate or misrepresent content through the shell interface. The network attack vector combined with user interaction requirement indicates the attack likely involves crafted network content or specially formed inputs that deceive the shell's trust mechanisms. The root cause classification under CWE-693 indicates the security control itself is flawed rather than bypassed through a traditional code execution pathway.

RemediationAI

Vendor-released patch available per Microsoft Security Response Center. Organizations should apply Windows updates containing the cumulative security patches for their respective OS versions, using the build numbers specified in the EUVD data as minimum patched versions (for example, Windows 10 Version 22H2 requires 10.0.19045.7184 or later). Updates can be deployed via Windows Update, WSUS, or manual patch installation from the Microsoft Update Catalog. For organizations unable to patch immediately, restrict network access to untrusted sources and educate users to avoid interacting with suspicious shell content or file operations from unknown origins. Consult https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32202 for specific patch delivery timelines and https://vuldb.com/vuln/357515 for additional mitigation context.